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Introduction 

The Homeland Security Council (HSC) - in partnership with the Department of Homeland 
Security (DHS), the federal interagency, and state and local homeland security agencies - has 
developed fifteen all-hazards planning scenarios for use in national, federal, state, and local 
homeland security preparedness activities. These scenarios are designed to be the foundational 
structure for the development of national preparedness standards from which homeland security 
capabilities can be measured. While these scenarios reflect a rigorous analytical effort by federal, 
state, and local homeland security experts, it is recognized that refinement and revision over time 
may be necessary to ensure the scenarios remain accurate, represent the evolving all-hazards 
threat picture, and embody the capabilities necessary to respond to domestic incidents. 

This document includes executive summaries for the fifteen scenarios, and a separate document 
contains the complete scenario text. 

General Considerations for the Scenarios: 

The scenarios have been developed in a way that allows them to be adapted to local conditions 
throughout the country. Although certain areas have special concerns - continuity of government 
in Washington, D.C.; viability of financial markets in New York; and trade and commerce in 
other major cities - every part of the country is vulnerable to one or more major hazards. 

Because the attacks could be caused by foreign terrorists; domestic radical groups; state- 
sponsored adversaries; or in some cases, disgruntled employees, the perpetrator has been named, 
the Universal Adversary (UA). The focus of the scenarios is on response capabilities and needs, 
not threat-based prevention activities. 

Since these scenarios were compiled to be the minimum number necessary to test the range of 
response capabilities and resources, other hazards were inevitably omitted. Examples of other 
potentially high- impact scenarios include nuclear power plant incidents 1 , industrial and 
transportation accidents, and frequently occurring natural disasters. These either have well- 
developed and tested response plans, and/or the response would be a subset of the requirements 
for scenarios contained in this set. 

Detailed assumptions for each scenario are provided in the full-text of this document but are not 
provided in this executive summary. 

Intelligence Disclaimer - 

While the intelligence picture developed as part of each scenario generally reflects suspected 
terrorist capabilities and known tradecraft, the Federal Bureau of Investigation (FBI) is unaware 



A severe incident at a nuclear power plant, whether or not it is terrorist-initiated, could result in a release of radioactive 
materials to the environment with adverse consequences to public health. Scenarios for such severe incidents have not been 
included in this scenario set because: (a) current federal regulations from the Nuclear Regulatory Commission and the DHS 
Federal Emergency Management Agency (FEMA) mandate robust emergency planning and preparedness for each nuclear plant 
to include the full range of response organizations; and (b) scenarios for nuclear plants cannot be generically extrapolated to other 
types of facilities (e.g., chemical plants). 



IV 



Version 2.0 



of any credible intelligence that indicates that such an attack is being planned, or that the agents 
or devices in question are in possession of any known terrorist group. 

Ranking of Scenarios - 

Various schemes have been used in the past to rank scenarios based on probability, number of 
casualties, extent of property damage, economic impact, and social disruption. Because the 
scenarios in this set were developed to test the full range of response capabilities and resources - 
and to assist federal, state, and local governments as well as the private sector in preparedness - 
they have not been ranked. Each jurisdiction or organization should apply its own priorities, 
based on its responsibilities within the domestic incident management structure. 

Multiple Events - 

There is a high probability that multiple incidents will occur simultaneously. When scoping 
resource requirements, organizations should always consider the need to respond to multiple 
incidents of the same type and multiple incidents of different types, at either the same or other 
geographic locations. These incidents will invariably require the coordination and cooperation of 
homeland security response organizations across multiple regional, state, and local jurisdictions. 

The Homeland Security Advisory System - 

The scenarios do not specify changes in the levels of the Homeland Security Advisory System 
(HSAS). However, in all scenarios other than natural disasters, it is anticipated that the alert level 
would increase. This increases the nation's ability to respond to the current attack, reduces the 
vulnerability to future attacks, and helps citizens prepare to protect themselves. At higher alert 
levels, the HSAS has increased resource demands and can also have national economic impacts. 

The "Worried Well" - 

In most incidents, citizens will seek medical treatment even though they may not be injured by 
the incident. For example, in the World Trade Center incident on 9/11/01, the uninjured who 
sought medical treatment was approximately fifteen times the number of people who presented 
for medical treatment due to smoke inhalation; and in the Tokyo subway attack it was five times 
the number of victims experiencing chemical poisoning. For planning purposes, most experts 
calculate a ratio often-to-one. 

Infrastructure Impact - 

The effect of disasters on national, state, and local transportation, communication, medical, and 
utility infrastructure will have a considerable effect on response strategies. As on 9/11, when the 
entire civilian air transportation system and much of the national telecommunications system 
were shut down or disabled, a terrorist incident may have repercussions that affect critical 
infrastructures necessary for coherent emergency response. These critical networks must be 
layered and properly coordinated across both civilian and military sectors to ensure the 
continuity of critical infrastructure support for responding jurisdictions. 

Economic Impact - 

Catastrophic disasters, depending upon the type, scope, and magnitude of the disaster incident, 
could threaten the economic sustainability of the communities affected and may cause severe 
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disruption and long-term economic damage. Extreme disaster incidents can generate cascading 
economic situations extending outside the immediate community. Even in moderate disasters, of 
all businesses that close following a disaster, more than 43% never reopen, and an additional 
29% close permanently within 2 years . The American Planning Association notes, "Economic 
recovery is quite likely the most serious issue facing most communities in the post-disaster 
period, and almost certainly the central issue in every major disaster." 

Environmental Impact - 

Catastrophic natural and manmade disasters and terrorist attacks can result in extreme 
environmental impacts that challenge government and community recovery time. Long after the 
emergency phase subsides, contamination from disasters may remain, consisting of chemical, 
biological, or radiological materials. While decontamination technologies may be well 
established for some types of contamination, others are only moderately effective - some 
contaminants, especially radionuclides, are very difficult and costly to remediate. While some 
decontamination techniques may be effective in small sites, these techniques may not be suited 
for decontaminating expansive areas of varying physical characteristics. Evacuation and 
relocation during cleanup and restoration activities can result in significant business loss and 
failure, leading to local and regional economic downturn. In addition, agricultural and industrial 
products from an area contaminated, or thought to be contaminated, can generate impacts that 
extend within a region and beyond. 

International Dimensions - 

It is important to underline the significant international dimensions that arise in connection with 
some of the more damaging and devastating scenarios in which significant loss of life and 
property, together with the possibility of foreign-directed terrorism, are involved. First, there is 
the hemispheric dimension of effects on U.S. relations with Canada and Mexico in terms of 
cross-border trade, transit, law enforcement coordination, and other key issues. Second, there is 
the immediate treaty connection the United States has with other North Atlantic Treaty 
Organization (NATO) allies if the United States comes under attack. Third, there is the 
significant lobbying the United States will undertake at the United Nations (UN) to articulate 
American needs and interests. In addition to humanitarian and law enforcement assistance from 
NATO allies, other nations may contribute special equipment in order to meet other necessities. 
Instances where a disaster or terrorist attack has disrupted major urban centers and international 
transit/trade routes through U.S. cities will typically require significant coordination with the 
State Department to ensure all economic, trade, commercial, consular, military cooperative, and 
humanitarian assistance is rendered as needed. 

The State Department plays several key roles in post-disaster situations. It assists foreign citizens 
affected by the incident. It identifies the specific needs of affected U.S. areas where foreign 
offers of assistance can be mediated and arranged. Moreover, in cases where explicit terrorist 
activities may have occurred, the State Department is a leader in facilitating the investigations 
abroad needed to determine the origins of the attack, in pursuing diplomatic and follow-up 



2 Institute for Business and Home Safety, at www.ibhs.org/business protection . 

Planning for Post-Disaster Recovery and Reconstruction (1998), American Planning Association-Federal Emergency 
Management Agency, Planning Advisory Service Report No. 483/484, p. 53. 
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policies related to finding the guilty parties abroad, and in rendering coordinated international 
assistance to U.S. recovery efforts. 

Common Response Threads: 

Media Access and Support - 

The support and cooperation of media in informing and protecting citizens is a critical aspect of 
emergency response. In many cases, media sources represent the best or only source of 
information available during the early stages of an incident. Cultivating good working 
relationships with the media provides opportunities to advise the public of important safety and 
health guidance and information and corrected misinformation, as well as to obtain critical 
information from news sources at the scene. Likewise, consistent public service guidance and 
information from emergency management officials to media sources are vital to reducing the 
probability of injury or illness and for alleviating citizen anxiety during the emergency. 

The Importance of Planning for Continuity of Operations - 

The scenarios reinforce the need for governments and the private sector to make preparations to 
continue their essential operations in an environment in which primary staff and facilities are 
unavailable. This includes the need to backup key records and systems. 

The Need for Capability-Based Planning - 

The scenarios emphasize the need for domestic incident preparedness to proceed through a 
capabilities-based approach. Although it is impossible to determine which major incident will 
occur next, examination of the scenarios leads to certain common functions that must be 
accomplished: the need for response organizations to move quickly and in a coordinated manner, 
the requirement to quickly treat mass casualties, and the need to temporarily house large 
numbers of people. Other considerations, such as treating infected animals or reconfiguring 
computer systems, are more incident-dependent. 
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Mission Areas: 

The following Mission Areas were used to assist in scoping the response requirements generated 
by the scenarios. 4 The full-text document contains detailed information for each Mission Area, 
and this executive summaries document highlights actions to be taken under each Mission Area. 



Prevention/Deterrence/Protection - 
Emergency Assessment/Diagnosis - 

Emergency Management/Response - 



Incident/Hazard Mitigation - 



Public Protection - 



Victim Care - 

Investigation/Apprehension 
Recovery/Remediation - 



The ability to prevent, deter, or protect against terrorist actions 

The ability to detect an incident, determine its impact, classify 
the incident, conduct environmental monitoring, and make 
government-to-government notifications 

The ability to direct, control, and coordinate a response; 
provide emergency public information to the population at 
risk and the population at large; and manage resources - this 
outcome includes direction and control through the Incident 
Command System (ICS), Emergency Operations Center 
(EOC), and Joint Information Center (JIC) 

The ability to control, collect, and contain an incident at its 
source and to mitigate the magnitude of its impact; this 
outcome also includes all response tasks conducted at the 
incident scene except those specifically associated with victim 
care 

The ability to provide initial warnings to the population at 
large and the population at risk, notifying people to shelter-in- 
place or evacuate; provide evacuee support (e.g., 
transportation for evacuees, reception center, sand shelters); 
protect schools and special populations; and manage traffic 
flow and access to the affected area 

The ability to treat victims at the scene, transport patients, 
treat patients at a medical treatment facility, track patients, 
handle and track human remains, and provide tracking and 
security of patients' possessions and evidence 

The ability to investigate the cause and source of the attack; 
prevent secondary attacks; and identify, apprehend, and 
prosecute those responsible 

The ability to restore essential services, restore businesses and 
commerce, cleanup the environment and render the affected 
area safe, compensate victims, provide long-term mental 
health and other services to victims and the public, and restore 
a sense of well-being in the community 



Department of Homeland Security, Office for Domestic Preparedness: Homeland Security Exercise and Evaluation Program, 
October 2003. 
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Scenario 1: Nuclear Detonation - 
10-Kiloton Improvised Nuclear Device 

Executive Summary 



Casualties 


Can vary widely 


Infrastructure Damage 


Total within radius of 0.5 to 1.0 mile 


Evacuations/Displaced Persons 


450,000 or more 


Contamination 


Approximately 3,000 square miles 


Economic Impact 


Hundreds of billions of dollars 


Potential for Multiple Events 


No 


Recovery Timeline 


Years 



Scenario Overview: 

General Description - 

In this scenario, terrorist members of the Universal Adversary (UA) group assemble a gun-type 
nuclear device using highly enriched uranium (HEU) - used here to mean weapons-grade 
uranium - stolen from a nuclear facility located in the former Soviet Union. The nuclear device 
components are smuggled into the United States. The 10-kiloton nuclear device is assembled 
near a major metropolitan center. Using a delivery van, terrorists transport the device to the 
central business district of a large city and detonate it. Most buildings within 1,000 meters (~ 
3,200 feet) of the detonation are severely damaged. Injuries from flying debris (missiles) may 
occur out to 6 kilometers (~ 3.7 miles). An Electromagnetic Pulse (EMP) damages many 
electronic devices within about 5 kilometers (~ 3 miles). A mushroom cloud rises above the city 
and begins to drift east-northeast. 

Geographical Considerations/Description - 

This scenario postulates a 10-kiloton nuclear detonation in a large metropolitan area. The effects 
of the damage from the blast, thermal radiation, prompt radiation, and the subsequent radioactive 
fallout have been calculated, based on a detonation in Washington, D.C. (details are not provided 
in this executive summary but are presented in the full-text version in Appendix 1-A). However, 
the calculation is general enough that most major cities in the United States can be substituted in 
a relatively straightforward manner. If the incident happened near the U.S. border, there would 
be a need for cooperation between the two border governments. Additionally, the IND attack 
may warrant the closure of U.S. borders for some period of time. If the detonation occurs in a 
coastal city, the fallout plume may be carried out over the water, causing a subsequent reduction 
in casualties. On the other hand, the surrounding water will likely restrict the zones that are 
suitable for evacuation. Bridges and tunnels that generally accompany coastal cities will restrict 
the evacuation, causing delay and an increase in the radioactive dose that evacuees receive. This 
delay may be substantial and the resulting dose increase may drive a decision to shelter-in-place 
or evacuate-in-stages. 
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Timeline/Event Dynamics - 

The response timeline will begin the instant the detonation occurs. Initially, only survivors in the 
immediate area will conduct rescue and lifesaving activities. Later (minutes to hours), rescue 
teams will begin to arrive and provide assistance. With the current state of education, training, 
and equipment, it is likely that many of these responders will subject themselves to very large 
(perhaps incapacitating or fatal) doses of radiation. As various command posts are setup (which 
may take hours to days), the response will become more coordinated. 

For a nuclear detonation, the actual occurrence of injuries does not stop when the immediate 
blast effects have subsided. The most critical components of the post-detonation response may 
not be the lifesaving efforts that assist the victims directly injured by the detonation. Instead, it is 
likely that the most effective lifesaving activities will be those that address the evacuation or 
sheltering-in-place decisions for the potential victims in the immediate fallout path, the effective 
communication of instructions to the affected population, and the efficient decontamination of 
the evacuated population. 

Secondary Hazards/Events - 

The detonation will cause many secondary hazards. The intense heat of the nuclear explosion 
and other subsequent causes will produce numerous fires located throughout the immediate blast 
zone. Damaged buildings, downed power and phone lines, leaking gas lines, broken water mains, 
and weakened bridges and tunnels are just some of the hazardous conditions that will need to be 
assessed. Depending on the type of industries present (such as chemical or petroleum production, 
industrial storage facilities, and manufacturing operations), there could be significant releases of 
hazardous materials. 

Another secondary effect of a nuclear explosion is the EMP that will be produced by the 
ionization and subsequent acceleration of electrons from the air and other materials by the 
intense radiation of the detonation. This EMP is a sharp, high-voltage spike that radiates out 
from the detonation site. It has the potential to disrupt the communication network, other 
electronic equipment, and associated systems within approximately a 5 -kilometer (~ 3 -mile) 
range from the 10-kiloton ground blast. 

There likely will be significant damage to the general public support infrastructure with 
potentially cascading effects. These systems include transportation lines and nodes (e.g., air, 
water, rail, highway); power generation and distribution systems; communications systems; food 
distribution; and fuel storage and distribution. There will be concerns about the safety and 
reliability of many structures (e.g., dams, levees, nuclear power plants, hazardous material 
storage facilities). Structures may be damaged that are used to provide essential services (e.g., 
hospitals, schools). 

Key Implications: 

A full description of the fatalities and injuries for a nuclear detonation is difficult and 
complicated. There will be casualties directly associated with the blast, which will cause 
"translation/tumbling" (the human body being thrown) and subsequent impacts of people and 
other objects. A nuclear detonation will also produce a great deal of thermal (heat) energy that 
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will cause burns to exposed skin (and eyes). There are two general "categories" of nuclear 
radiation produced in a detonation. First is the so-called "prompt" nuclear radiation, arbitrarily 
defined as being emitted within the first minute - it is actually produced as the device detonates 
or shortly thereafter. For a 10-kiloton blast, this radiation may expose unprotected people within 
a distance of a few kilometers (a couple of miles) to extremely large gamma ray and/or neutron 
doses. In addition, a detonation of a nuclear device near the surface of the ground will result in a 
great deal of fallout (in the form of dirt particles) that is radioactively contaminated. This fallout 
will settle out of the radioactive cloud over a period of minutes to weeks. By far, the most 
dangerously radioactive fallout will be deposited near the detonation site and will happen within 
the first couple of hours after detonation. Radioactive fallout will exponentially decay with time, 
but may expose many people to large doses and will certainly contaminate large areas of land for 
years. Many fatalities and injuries will result from a combination of these various effects. 

The largest radiation concerns following an IND incident will be the "prompt" radiation (gamma 
ray and neutron) and the gamma dose received from the "ground shine" (radioactive particles 
deposited on the ground) as people are evacuated from the fallout areas. These effects are likely 
to have significantly larger impacts on the population than internal doses. Internal doses tend to 
expose the body to relatively small radiation doses over a long period of time, which produces 
different effects than large radiation doses received during a short period of time. 

As the distance from ground zero increases past 20 kilometers (-12 miles), the injuries due to 
acute radiation exposure (from prompt radiation and the subsequent fallout) will decrease, and 
lower level contamination, evacuation, and sheltering issues will become the major concern. In 
general, at distances greater than 250 kilometers (~ 150 miles) from ground zero of a 10 kiloton 
nuclear detonation, acute health concerns will not be a significant issue. However, contamination 
of people and the environment will still be a concern. 

Years later, there will still be health consequences in the form of increased probabilities of 
cancers in the exposed population. The number of these cancers will likely run into the thousands 
and will extract a large human, social, and financial cost. 

It is likely that the blast and subsequent fires will destroy all buildings in the immediate area of 
the detonation. Historically, decontamination of sites involves the removal of all affected 
material, so most buildings in the immediate downwind fallout path will likely have to be 
destroyed in the decontamination effort. As the distance from the detonation site increases, the 
contamination level will decrease. At some distance, the buildings will not have to be destroyed 
and removed but will still require decontamination of all affected surfaces. This decontamination 
process will take years and will be extremely expensive. The decontamination will produce a far 
greater challenge and cost much more than the actual rebuilding of the destroyed structures. 
Approximately 8,000 square kilometers (~ 3,000 square miles) of land will have to undergo 
varying degrees of decontamination. This effort will last for many years and will cost many 
billions of dollars to complete. 

Service disruption will be extensive in the area near ground zero and in the fallout path for 
several miles downwind. Services in these areas will not be restored for years because the land 
affected will not be returned to use until the decontamination is complete and the structures 
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rebuilt. Service disruption will be much less dramatic in areas that are less severely contaminated 
or not contaminated at all. 

The electrical power grid is likely to be damaged by transients produced by the destruction of 
substations, as well as other power production and distribution installations, and perhaps by the 
EMP of the detonation. It is likely that the grid damage may cause power outages over wide 
areas, perhaps over several states, but these outages should be repaired within several days to a 
couple of weeks. The communication systems in the area will suffer similar damage and will 
likely be repaired within similar timeframes. 

City water mains will likely survive without major damage. The city water supply is unlikely to 
become substantially contaminated with radiation via water main breaks, but it is possible that 
some small amount of radioactive and non-radioactive contamination may enter the lines. 

To varying degrees, all government services will be impacted over some geographical area. The 
national economy will be significantly impacted. Decontamination, disposal, and replacement of 
lost infrastructure will cost many billions of dollars. Replacement of lost private property and 
goods could add billions more to the cost. Additionally, an overall national economic downturn, 
if not recession, is probable in the wake of the attack. 



Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis - 



Emergency Management/Response 



Incident/Hazard Mitigation - 



Law enforcement attempts will be made to prevent development and 
detonation of the device. Site boundaries must be protected and 
surveyed after the detonation. Officers must respond to any 
additional threats or looting/theft issues. 

The detonation will be easily recognized as nuclear. Actions 
required include dispatching response units; making incident scene 
reports; detecting and identifying the source; establishing a 
perimeter; collecting information; making hazard assessments and 
predictions; coordinating hospital and urgent care facilities; 
coordinating county and state response requests; and coordinating 
monitoring, surveying, and sampling operations. 

Evacuation/shelter-in-place decisions must be made immediately. 
Required actions include alerting the public, providing traffic and 
access control, protecting at-risk and special populations, supporting 
requests for assistance, directing and controlling critical 
infrastructure assets, and directing pubic information activities. 
Location and removal of injured and disabled people will be a 
significant undertaking that will be greatly complicated by the need 
to keep the radiation dose of the individual workers as low as 
reasonably achievable (ALARA). Initial emergency workers will 
likely receive high doses of radiation and must be trained on how to 
avoid as much as possible. 

Self-evacuation should occur in the short-term, and the greatest 
factor impacting the reduction of the effects of the detonation on the 
general population will remain the speed and appropriateness of the 
decisions that are made and the effectiveness of the dissemination of 
this information (e.g., evacuation/shelter-in-place instructions). 



1-4 



Version 2.0 



Public Protection - 



Victim Care - 



Investigation/Apprehension 



Recovery/Remediation 



Evacuees must be promptly decontaminated. 

Actions should include making and communicating protective action 
decisions, monitoring and decontaminating evacuees, implementing 
decisions to administer prophylaxis to the affected populations, 
protecting special populations, protecting schools and day care 
facilities, and providing shelter/reception facilities. 

Tens of thousands will require decontamination and both short-term 
and long-term treatment. Due to a high number of casualties, the 
level of care may be significantly lower than normally expected. 
When overwhelmed with victims who need care, decisions must be 
made based on the fact that the sooner the onset of the symptoms, 
the higher the dose received and the less likely the victim is to 
survive (even with medical intervention). 

Attribution activities at the detonation site will rely largely on 
scientific forensic techniques and will be provided by specialized 
national teams. Actions of incident-site personnel will include site 
control and criminal investigation. Federal authorities or the military 
will probably conduct "apprehension" activities. 

Expected radiation levels will limit the total time workers can spend 
in the affected area, quickly leading to a shortage of willing, 
qualified, and trained workers. The volume of contaminated material 
that will be removed will overwhelm the national hazardous waste 
disposal facilities and will severely challenge the nation's ability to 
transport the material. This effort will be the most expensive and 
time-consuming part of recovery and will likely cost many billions 
of dollars and take many years. 



Note: For more information, there are two sections available only in the full-text version of this 
document that provide more detailed information regarding results. There is an Estimated 
"Realistic" Results section that reflects a set of possible results from the 10-kiloton detonation 
described in this scenario. The second section, Appendix 1-A, contains a consequence report for 
a 10-kiloton nuclear detonation in Washington, DC, that describes a set of possible consequences 
calculated for a 10-kiloton nuclear blast including its prompt effects (occurring within the first 
minute) and fallout. The results provided in Appendix 1-A are very conservative, and the results 
provided in the section, Estimated "Realistic " Results are less conservative and are intended to 
be more realistic. 
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Scenario 2: Biological Attack - Aerosol Anthrax 

Executive Summary 



Casualties 


13,000 fatalities and injuries 


Infrastructure Damage 


Minimal, other than contamination 


Evacuations/Displaced Persons 


Possibly 


Contamination 


Extensive 


Economic Impact 


Billions of dollars 


Potential for Multiple Events 


Yes 


Recovery Timeline 


Months 



Scenario Overview: 

General Description - 

Anthrax spores delivered by aerosol delivery results in inhalation anthrax, which develops when 
the bacterial organism, Bacillus anthracis, is inhaled into the lungs. A progressive infection 
follows. This scenario describes a single aerosol anthrax attack in one city delivered by a truck 
using a concealed improvised spraying device in a densely populated urban city with a 
significant commuter workforce. It does not, however, exclude the possibility of multiple attacks 
in disparate cities or time-phased attacks (i.e., "reload"). For federal planning purposes, it will be 
assumed that the Universal Adversary (UA) will attack five separate metropolitan areas in a 
sequential manner. Three cities will be attacked initially, followed by two additional cities 2 
weeks later. 

Timeline/Event Dynamics — 

It is possible that a Bio-Watch signal would be received and processed, but this is not likely to 
occur until the day after the release. The first cases of anthrax would begin to present to 
Emergency Rooms (ERs) approximately 36 hours post-release, with rapid progression of 
symptoms and fatalities in untreated (or inappropriately treated) patients. 

The situation in the hospitals will be complicated by the following facts: The release has 
occurred at the beginning of an unusually early influenza season and the prodromal symptoms of 
inhalation anthrax are relatively non-specific. Physician uncertainty will result in low thresholds 
for admission and administration of available countermeasures (e.g., antibiotics), producing 
severe strains on commercially available supplies of such medications as ciprofloxacin and 
doxycycline, and exacerbating the surge capacity problem. 

Secondary Hazards/Events - 

Social order questions will arise. The public will want to know very quickly if it is safe to remain 
in the affected city and surrounding regions. Many persons will flee regardless of the public 
health guidance that is provided. Pressure may be placed directly on pharmacies to dispense 
medical countermeasures directly, and it will be necessary to provide public health guidance in 
more than a dozen languages. 
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Key Implications: 

This attack results in 328,484 exposures; 13,208 untreated fatalities; and 13,342 total casualties. 
Although property damage will be minimal, city services will be hampered by safety concerns. 

There is the potential for a huge sell-off in the economic markets; moreover, the stock exchange 
and large businesses may be directly affected by the attack. There may also be a decline in 
consumer spending and a loss of revenue for the metropolitan area. An overall national economic 
downturn is possible in the wake of the attack due to loss of consumer confidence. The costs of 
the closure of a large section of the city and the decrease in revenue from tourism for an 
indeterminate period would be enormous, as would the costs of remediation and 
decontamination. 



Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis - 



Emergency Management/Response - 



Incident/Hazard Mitigation 



Public Protection - 

Victim Care - 
Investigation/Apprehension - 

Recovery/Remediation - 



This area requires knowledge of those with the ability to grow and 
aerosolize anthrax, reconnaissance of equipment and laboratories, 
and public health protection measures. 

It will be necessary to monitor attack impact, determine resource 
needs, classify the type of event, and identify other events (if any). 
Environmental sampling for exposure risk assessment, identification 
of anthrax strain, and determination of any drug resistance will also 
be required. 

Management and response will require public alerts, mobilization of 
the Strategic National Stockpile, activation of treatment sites, 
traffic/access control, special population protection, protective 
measures (e.g., shelter-in-place), requests for resources and 
assistance, and public information activities. 

Mitigation will require PEP and PPE provision, environmental 
testing/decontamination, care of ill persons, victim treatment, site 
remediation and monitoring, notification of airlines/transport 
providers, public information provision, and coordination with 
public health agencies. 

In order to protect the public, it will be necessary to provide 
symptom/exposure information, warnings, and shelter-in- 
place/evacuation notification, as well as to manage traffic/access 
flow and mobilize the Strategic National Stockpile. 

Care to the ill must be provided and should include disbursing 
PEP/vaccinations and establishing treatment/distribution centers. 

Law enforcement will investigate the attack in collaboration with 
public health officials working to identify populations at risk of 
disease. This also requires epidemiological trace-back of victims, 
parallel criminal investigations, and laboratory analyses. 

The Environmental Protection Agency (EPA) and the CDC will 
coordinate this area. Extensive decontamination and cleanup will be 
required (anthrax is long-lived in the environment) costing billions 
of dollars. Remediation will also require environmental testing, 
highly contaminated area closures, and public information provision. 
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Scenario 3: Biological Disease Outbreak - Pandemic Influenza 

Executive Summary 



Casualties At a 15% attack rate: 87,000 fatalities; 300,000 

hospitalizations 

Infrastructure Damage None 



Evacuations/Displaced Persons Isolation of exposed persons 



Contamination None 

Economic Impact $70 to $160 billion 

Potential for Multiple Events Yes, would be worldwide nearly simultaneously 



Recovery Timeline Several months 



Scenario Overview: 1 

General Description - 

Influenza pandemics have occurred every 10 to 60 years, with three occurring in the twentieth 
century (1918, 1957-1958, and 1967-1968). Influenza pandemics occur when there is a notable 
genetic change (termed genetic shift) in the circulating strain of influenza. Because of this 
genetic shift, a large portion of the human population is entirely vulnerable to infection from the 
new pandemic strain. 

This scenario hypothetically relates what could happen during the next influenza pandemic 
without an effective preplanned response. At least twenty-five cases occur first in a small village 
in south China. Over the next 2 months, outbreaks begin to appear in Hong Kong, Singapore, 
South Korea, and Japan. Although cases are reported in all age groups, young adults appear to be 
the most severely affected, and case-fatality rates approach 5%. Several weeks later, the virus 
appears in four major U.S. cities. By nature, pandemic influenza moves extremely rapidly, and 
the outbreaks continue. 

Timeline/Event Dynamics — 

When planning and preparing for the next influenza pandemic, there are two equally important 
timelines. Due to the rapid spread of the influenza pandemic and the time required to develop, 
test, produce, and distribute an effective vaccine, the disease will likely arrive in the United 
States before a "significant" number of people can be vaccinated. The implication of this is that, 
as part of any pandemic influenza preparation and response plan, there must be a mechanism for 
allocating the vaccine among the population. 

Secondary Hazards/Events - 

The greatest secondary hazard will be the problems caused by shortages of medical supplies 
(e.g., vaccines and antiviral drugs), equipment (e.g., mechanical ventilators), hospital beds, and 



Adapted from Patriarcia et al., Pandemic influenza: A planning guide for state and local officials (draft 2. 1). Available from 
http://www.cdc.gov/od/nvpo/pubs/pandemicflu.htm. 
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health care workers. Having a detailed system for allocating resources potentially can reduce 
such difficulties. This system ideally should be in place well before an influenza pandemic 
actually occurs. Also of particular concern is the real likelihood that health care systems, 
particularly hospitals, will be overwhelmed. Another important secondary hazard is the 
disruption that might occur in society. Institutions, such as schools and workplaces, may close 
because a large proportion of students or employees are ill. A large array of essential services 
may be limited because workers are off work due to pandemic influenza. Travel between cities 
and countries may be sharply reduced. 

Key Implications: 

Estimates of impact are provided in Table 3-1. 



Health Outcomes 


15% Gross Attack Rate* 
(5 th , 95 th percentiles) 


15% Gross Attack Rate 
(5 th , 95 th percentiles) 


Fatalities 


87,000 
(54,400; 122,200) 


207,000 
(127,200; 285,300) 


Hospitalizations 


314,400 
(210,400; 417,200) 


733,800 
(491,000; 973,500) 


Outpatient visits 


18.1 million 
(17.5; 18.7) 


42.2 million 
(40.8; 43.7) 


Self-care ill 


21.3 million 
(20.6; 21.9) 


49.7 million 
(48.2; 51.2) 


*Percent Gross Attack Rate refers to the percentage of the entire U.S. population that will have a 
clinical case of influenza. 



Note: Assumptions for these estimates are available in the full-text version of this scenario, which also includes an 
Appendix 3-C that provides graphs and additional estimates. 

Table 3-1. Mean estimates (5 f , 95 l percentiles) of the impact of the next influenza pandemic in 
the United States without any large-scale and/or effective interventions 



Property damage is minimal. Service disruption, however, could be severe due to worker illness. 
Health care systems will be severely stressed, if not overwhelmed, and first responders are also 
likely to be severely strained. 

Based on the estimates in Table 3-1, the economic impact, in 1995 U.S. dollars, will range from 
$71 billion (15% gross attack rate) to $166 billion (35% gross attack rate). These estimates 
include a value for time lost from work but do not include any estimate due to economic 
disruption or long-term health care costs. 
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Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis - 
Emergency Management/Response - 

Incident/Hazard Mitigation - 
Public Protection - 

Victim Care - 



Investigation/Apprehension - 



Recovery/Remediation - 



Prevention is currently impossible. Protection requires pre -pandemic 
preparedness, providing more vaccines and conducting more vaccine 
research and development, antiviral drug stockpiling, and increased 
surveillance capacity to track illness patterns. 

U.S. influenza surveillance systems will be activated. However, 
more information is needed regarding attack rate measurements. 

Preparedness plans should contain clear guidelines on setting 
priorities for the use of scarce resources such as vaccines, drugs, and 
hospital beds. Federal and state governments have such plans in 
progress but not all are complete. 

Success depends on the availability of scarce resources and how 
well these resources are distributed. Timely, effective public 
information communication is also important. 

Due to late-onset symptoms and the rapid rate at which the disease 
spreads, evacuation and quarantine are not recommended. Protection 
will rely on vaccines and antiviral drugs to prevent spread of the 
disease. 

Will rely on the use of antiviral drugs for treatment. Hospitalization 
and mechanical ventilators will be necessary for many and likely be 
in short supply. However, at-home care and over-the-counter 
medications may be helpful for some. A large number of fatalities 
will likely occur, requiring mortuary and burial services. 

Investigation is dependent on disease surveillance, although the 
current system has distinct limitations. 

Not required. 
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Scenario 4: Biological Attack - Plague 

Executive Summary 



Casualties 2,500 fatalities; 7,000 injuries 

Infrastructure Damage None 

Evacuations/Displaced Persons Possibly 



Contamination Lasts for hours 



Economic Impact Millions of dollars 

Potential for Multiple Events Yes 
Recovery Timeline Weeks 



Scenario Overview: 

General Description - 

Plague is a bacterium that causes high mortality in untreated cases and has epidemic potential. It 
is best known as the cause of Justinian's Plague (in the middle sixth century) and the Black 
Death (in the middle fourteenth century), two pandemics that killed millions. In this scenario, 
members of the Universal Adversary (UA) release pneumonic plague into three main areas of a 
major metropolitan city - in the bathrooms of the city's major airport, at the city's main sports 
arena, and at the city's major train station. 

Timeline/Event Dynamics — 

Plague cases rapidly occur in the United States and Canada. As a result of foreign and domestic 
travel, rapid dissemination to distant locations occurs. By Day 3, the plague spreads across both the 
Pacific and Atlantic oceans and by Day 4, the plague is confirmed in eleven countries other than 
the United States and Canada. 

Secondary Hazards/Events - 

As the financial world in Major City and elsewhere begins to realize the likelihood of an epidemic, 
a huge sell-off occurs in the markets. There is a high absentee rate at banks, other financial 
institutions, and major corporations. Adding to these complications is the fact that bank and other 
financial customers may be staying home. As a result, the phone systems at financial institutions 
may become completely tied up, with far fewer transactions than normal occurring. The fear of 
plague has raised memories of the anthrax incidents of 2001, which may cause many citizens to be 
afraid to open their mail. 

Key Implications: 

Morbidity and mortality totals by the end of the fourth day are indicated in Table 4-1. Although the 
specific assumptions that underlie these totals are not generally available, nor can they be reliably 
recreated, the parameters affecting these figures include length of incubation period following 
primary exposure, rate of secondary transmission, incubation period following secondary exposure, 
and timing and effectiveness of the intervention. 
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Illnesses and Fatalities by Country 




Illnesses 


Fatalities 


United States 


7,348 


2,287 


Canada 


787 


246 


Other Countries 


33 


10 


Total 


8,168 


2,543 



Table 4-1. Total illnesses and fatalities by country by the end of the fourth day (end of the exercise) 



Although the actual physical damage to property will be negligible, there will be an associated 
negative impact of buildings and areas that were or could have been contaminated. Service 
disruption will be significant for call centers, pharmacies, and hospitals due to overwhelming 
casualty needs. It will be necessary to close or restrict certain transportation modes. The threat of 
reduced food supply will cause food prices to rise. 

A huge sell-off in the economic markets is possible, and loss of life will result in a decline in 
consumer spending and subsequent loss of revenue in the metropolitan area. An overall national 
economic downturn is possible in the wake of the attack due to loss of consumer confidence. 

Many people will be killed, permanently disabled, or sick as a result of the plague. The primary 
illness will be pneumonia, although the plague can also cause septicemia, circulatory 
complications, and other manifestations. The long-term effects of antimicrobial prophylaxis in 
large numbers will require follow-up study. The associated mental health issues relating to mass 
trauma and terrorism events will also require assessment. 
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Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis 



Emergency Management/Response 



Incident/Hazard Mitigation - 



Public Protection - 



Victim Care 



Investigation/Apprehension 
Recovery/Remediation - 



This area requires knowledge of persons with the skills to grow and 
aerosolize plague, reconnaissance of supplies and laboratories, and 
public health protection measures. 

Although health professionals should rapidly recognize the 
seriousness of the incident, diagnosis of the plague may be delayed. 
Detection of the plague should initiate laboratory identification of 
the strain and a determination of the potentially known antimicrobial 
drug resistance. Origin of the initial contaminant should be traced 
back to the source. 

Identification of drug-resistant plague strains would require full 
utilization of personal protective equipment (PPE) and quarantine 
measures. Response will require provision of public alerts, 
mobilization of the National Strategic Stockpile, activation of 
treatment sites, traffic and access control, protection of special 
populations, potential quarantine measures including shelter-in-place 
recommendations, requests for resources and assistance, and public 
information activities. Effective communication between U.S. and 
Canadian governments is vital. 

Victims must receive antibiotic therapy within 24 hours to prevent 
fatality. Exposed victims must be isolated and minimizing disease 
spread will require epidemiological assessments, including contact 
investigation and notification. 

Victims must be evacuated and treated (and/or self-quarantined), 
and antimicrobial prophylaxis will be necessary for exposed 
persons, responders, and pertinent health care workers. Mobilization 
of the Strategic National Stockpile for additional critical supplies 
and antibiotics will be necessary. The public should be informed of 
signs and symptoms of plague. 

Victims will require treatment or prophylaxis with ventilators and 
antibiotics, as well as information measures for preventing spread of 
the disease. Advanced hospital care will be required for those with 
pneumonia. The U.S. Department of State's Bureau of Consular 
Affairs will need to be involved in order to assist foreign 
populations residing in the United States, or U.S. citizens exposed or 
ill abroad. 

Point-of-source exposures and plague strain must be determined 
using victim trace-back, criminal investigation, and laboratory 
analyses. 

Extensive decontamination and cleanup will not be necessary 
because plague cannot live long in the environment and is viable to 
heat and sunlight exposure. However, some efforts should be 
undertaken to support political/public confidence. 
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Scenario 5: Chemical Attack - Blister Agent 

Executive Summary 



Casualties 150 fatalities; 70,000 hospitalized 

Infrastructure Damage Minimal 

Evacuations/Displaced Persons More than 100,000 



Contamination Structures affected 



Economic Impact $500 million 

Potential for Multiple Events Yes 

Recovery Timeline Weeks; many long-term health affects 



Scenario Overview: 

General Description - 

Agent YELLOW, which is a mixture of the blister agents sulfur Mustard and Lewisite, is a liquid 
with a garlic-like odor. Individuals who breathe this mixture may experience damage to the 
respiratory system. Contact with the skin or eye can result in serious burns. Lewisite or Mustard- 
Lewisite also can cause damage to bone marrow and blood vessels. Exposure to high levels may 
be fatal. 

In this scenario, the Universal Adversary (UA) uses a light aircraft to spray chemical agent 
YELLOW into a packed college football stadium. The agent directly contaminates the stadium 
and the immediate surrounding area, and generates a downwind vapor hazard. The attack causes 
a large number of casualties that require urgent and long-term medical treatment, but few 
immediate fatalities occur. Of the total stadium attendance, 70% is exposed to the liquid at the 
time of the attack. The remaining 30% (i.e., those in the covered areas of the stadium), plus 10% 
of the total population in the vapor hazard area, are exposed to vapor contamination. 

Timeline/Event Dynamics - 

The total time of the attack, including the last mile of the plane's approach, is less than 5 
minutes. The crowd will panic and immediately evacuate the stadium, which will require up to 
30 minutes. First responders should begin arriving at the facility perimeter within 10 to 15 
minutes of the attack. In order for the UA to succeed in this attack, certain meteorological 
conditions - wind speed, temperature, humidity, and precipitation - must be met. 

Secondary Hazards/Events - 

Numerous injuries will occur as a result of crowd panic, including those that result from falling 
and crushing. Further injuries are likely to occur due to motor vehicle accidents in the parking lot 
and surrounding roadways. 
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Key Implications: 

In the case of a full, 100,000-seat stadium, 70,000 people (70%) may be contaminated in the 
attack. Of these, most will have only clothing and/or skin contamination, resulting in moderate- 
to-severe skin blisters that will appear in 2 to 12 hours. Expedient decontamination (i.e., clothing 
removal and heavy water spray) will avoid half of these injuries. Systemic arsenic poisoning will 
occur in highly contaminated individuals. However, many will inhale sufficient agent vapor to 
cause severe lung damage, and many more will sustain permanent damage to the eyes. Fatalities 
and major injuries will occur due to falling and crushing during the evacuation, and to vehicle 
accidents. 

There will be little direct property damage due to the attack. However, the stadium site and other 
contaminated property will be a total loss due to decontamination measures and/or psychological 
impacts of future usability. 

Loss of use of the stadium and adjacent athletic facilities is expected. Additionally, some public 
transportation and other facilities may be lost due to contamination carried by fleeing victims. 
Overwhelming demand will disrupt communications (landline telephone and cellular) in the 
local area. Finally, some victims may self-transport to health care facilities and contaminate 
those facilities. 

Decontamination, destruction, disposal, and replacement of a major stadium could cost up to 
$500 million. Enrollment at the college will be negatively affected, and the local community will 
experience significant losses resulting from the attack. Additionally, an overall national 
economic downturn is possible in the wake of the attack due to a loss of consumer confidence. 

Many will be permanently blinded and many more will carry lifetime scars. Many may suffer 
significant damage to the lungs. In addition, Mustard is a known carcinogen, and systemic 
poisoning from the arsenic in Lewisite is also a concern. 
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Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis 



Emergency Management/Response 



Incident/Hazard Mitigation 



Public Protection - 



Victim Care - 



Investigation/Apprehension - 



Recovery/Remediation - 



The ability to prevent the attack is contingent on the prevention of 
chemical warfare material (CWM) importation, weapon assembly, 
plane and pilot acquisition, and site reconnaissance. 

Hazardous material (HazMat) teams should instantly recognize the 
attack. Liquid contamination and a downwind vapor hazard will be 
components of the hazard. Actions required include dispatch; agent 
detection; and hazard assessment, prediction, monitoring, and 
sampling. 

Actions required include alerts, activation and notification, traffic 
and access control, protection of special populations, resource 
support and requests for assistance, and pubic information activities. 

The spread of contamination by fleeing victims will be a major 
challenge. Actions required include isolating and defining the 
hazard; establishing, planning, and operating incident command; 
preserving the scene; conducting mitigation efforts; decontaminating 
responders; and conducting site remediation and monitoring. 

Evacuation and/or sheltering of downwind populations in a 360- 
degree arc around the stadium will be required until the stadium is 
decontaminated. 

Tens of thousands of people will require decontamination and both 
short- and long-term medical treatment. 

Actions required include aircraft tracking, dispatch, site control, 
criminal investigation, tactical deployment, and suspect 
apprehension. 

The stadium and adjacent facilities must be decontaminated of liquid 
agent YELLOW. Decontamination waste disposal is complicated by 
the presence of arsenic. Environmental testing must be done. 
Although decontamination could technically restore the stadium, 
psychological impact will likely require the stadium to be rebuilt. 
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Scenario 6: Chemical Attack- Toxic Industrial Chemicals 

Executive Summary 



Casualties 350 fatalities; 1,000 hospitalizations 

Infrastructure Damage 50% of structures in area of explosion 

Evacuations/Displaced Persons Up to 700,000 



Contamination Yes 



Economic Impact Billions of dollars 

Potential for Multiple Events Yes 
Recovery Timeline Months 



Scenario Overview: 

General Description - 

In this scenario, terrorists from the Universal Adversary (UA) land in several helicopters at fixed 
facility petroleum refineries. They quickly launch rocket-propelled grenades (RPGs) and plant 
improvised explosive devices (IEDs) before re-boarding and departing, resulting in major fires. 
At the same time, multiple cargo containers at a nearby port explode aboard or near several cargo 
ships with resulting fires. Two of the ships contain flammable liquids or solids. The wind is 
headed in the north-northeast direction, and there is a large, heavy plume of smoke drifting into 
heavily populated areas and releasing various metals into the air. One of the burning ships in the 
port contains resins and coatings including isocyanates, nitriles, and epoxy resins. Some IEDs are 
set for delayed detonation. Casualties occur onsite due to explosive blast and fragmentation, fire, 
and vapor/liquid exposure to the toxic industrial chemical (TIC). Downwind casualties occur due 
to vapor exposure. 

Timeline/Event Dynamics - 

Total time to plan and prepare for the attack would be on the order of 2 years, including 
reconnaissance, pilot and weapons training, and accumulation of weapons. Time to execute the 
attack would be several weeks to coordinate the shipping and coincident arrival of the containers 
aboard separate ships at the port. Time to execute the airborne phase of the attack would be on 
the order of 1 to 2 hours from liftoff from the originating airport. Time over target for the 
helicopters would be about 10 minutes. Time on the ground would be 2 to 3 minutes at each site. 
Fires resulting from the attack would take many hours, possibly days, to extinguish. In order for 
the UA to succeed in this attack, certain meteorological conditions - wind speed, temperature, 
humidity, and precipitation - must be met. 

Secondary Hazards/Events - 

Once they grasp the situation, authorities will evacuate or order shelter-in-place for a significant 
area downwind of the refineries and the port. Numerous injuries will occur as a result of 
population panic once downwind casualties begin to occur. Further injuries are likely to occur 
due to motor vehicle accidents in the surrounding roadways. (The rule of thumb is one fatality 
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per 10,000 evacuated.) Significant contamination of the waterway may also result, including oil 
and cargo spills from sunk or burning ships. 
Key Implications: 

Assuming a densely populated area, 7,000 people may be in the actual downwind area. Of these, 
5% (350) will receive lethal exposures, and half of these will die before or during treatment. An 
additional 15% will require hospitalization, and the remainder will be treated and released at the 
scene by Emergency Medical Service (EMS) personnel. However, approximately 70,000 
"worried well" may seek treatment at local medical facilities. 

All three refineries sustain significant damage, with 50% of the equipment and facilities 
requiring significant repairs or replacement. Two ships in the port sink at their moorings; the port 
sustains heavy damage near the ships and at a dozen points where IEDs were dropped. 
Depending on which chemicals are released, there may be significant property damage in the 
downwind area. 

Refinery capacity on the west coast is significantly diminished, resulting in fuel shortages and 
price increases. The port is temporarily closed due to damage and contamination. Contamination 
in the waterway may also result. Some public transportation and other facilities may be lost. 
Overwhelming demand will disrupt communications (landline telephone and cellular) in the 
local area. Significant disruptions in health care occur due to the overwhelming demand of the 
injured and the "worried well." 

Decontamination, destruction, disposal, and replacement of major portions of the refineries could 
cost billions of dollars. Similar costs could be expected at the port. Loss of the port will have a 
significant impact on U.S. trade with the Pacific Rim. An overall national economic downturn is 
possible in the wake of the attack due to a loss of consumer confidence. 

In addition to their toxic effects, many TICs are known carcinogens. Long-term damage to 
internal organs and eyes is possible, depending on which TICs are present. 
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Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis - 

Emergency Management/Response - 
Incident/Hazard Mitigation - 



Public Protection - 
Victim Care - 

Investigation/Apprehension - 



Recovery/Remediation 



Avoiding an attack would require prevention of aircraft and 
weapons acquisition, IED assembly, and site reconnaissance. 

The presence of multiple chemicals and exposure symptoms will 
greatly complicate assessment and identification efforts. Actions 
required include dispatch; TIC detection; and hazard assessment, 
prediction, monitoring, and sampling. 

Actions required include alerts, activation and notification, traffic 
and access control, protection of special populations, resource 
support and requests for assistance, and pubic information activities. 

Mitigation measures will be complicated by multiple TICs and 
secondary device concerns. Actions required include isolating and 
defining the hazard; establishing, planning, and operating incident 
command; firefighting; performing bomb disposal dispatch and IED 
render-safe procedures; preserving the scene; conducting mitigation 
efforts; decontaminating responders; and performing site 
remediation and monitoring. 

Evacuation and/or sheltering of downwind populations will be 
required. 

Injuries to be treated will include trauma, burns, smoke inhalation, 
severe respiratory distress, seizures, and/or comas. Short- and long- 
term treatment will be required as well as decontamination. 

Searching for suspects and evidence in an industrial area while 
wearing personal protective equipment (PPE) will be a significant 
challenge. Actions required include dispatch, site control, criminal 
investigation, pursuit and tactical deployment, and apprehension of 
suspects. 

The extent of decontamination required will depend on the TIC. 
Regardless, monitoring and sampling a large industrial port facility 
and refineries will be a challenge. Site restoration will be a major 
challenge, particularly for the refineries. Environmental impact 
issues are likely to significantly delay rebuilding efforts. 
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Scenario 7: Chemical Attack - Nerve Agent 
Executive Summary 



Casualties 


6,000 fatalities (95% of building occupants); 


350 injuries 


Infrastructure Damage 


Minimal, other than contamination 


Evacuations/Displaced Persons 


Yes 


Contamination 


Extensive 


Economic Impact 


$300 million 


Potential for Multiple Events 


Extensive 


Recovery Timeline 


3 to 4 months 



Scenario Overview: 

General Description - 

Sarin is a human-made chemical warfare agent classified as a nerve agent. Nerve agents are the 
most toxic and rapidly acting of the known chemical warfare agents. Sarin is a clear, colorless, 
and tasteless liquid that has no odor in its pure form. However, Sarin can evaporate into a vapor 
and spread into the environment. Sarin is also known as GB. 

In this scenario, the Universal Adversary (UA) builds six spray dissemination devices and 
releases Sarin vapor into the ventilation systems of three large commercial office buildings in a 
metropolitan area. The agent kills 95% of the people in the buildings, and kills or sickens many 
of the first responders. In addition, some of the agent exits through rooftop ventilation stacks, 
creating a downwind hazard. 

For purposes of estimating federal response requirements, each building is assumed to have an 
occupancy of 2,000 personnel (i.e., twenty-story buildings with 100 occupants per floor), and the 
outdoor/subway population density of the surrounding areas is 3,900 people per square mile 
(one-tenth of the total population density in the vicinity of Times Square, New York). 

Timeline/Event Dynamics — 

The attack will require 6 months to plan, including putting faux janitors in place, shipping the 
agent, and fabricating the spray devices. The actual attack will take less than 10 minutes. First 
responders should arrive at the facility within 10 to 15 minutes of the attack. In order for the UA 
to succeed in this attack, certain meteorological conditions - wind speed, temperature, humidity, 
and precipitation - must be met. 

Secondary Hazards/Events - 

Numerous injuries will occur as a result of panic on the street, including falling and crushing 
injuries. Further injuries are likely to occur due to motor vehicle accidents in the surrounding 
roadways. 
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Key Implications: 

Assuming 2,000 occupants per building, the initial fatality count will be 5,700 (95%) and 300 
injured, including the initial Emergency Medical Service (EMS) and fire personnel at each 
building. Patients who experience prolonged seizures may sustain permanent damage to the 
central nervous system - assume 350 patients in this category (300 inside plus 50 outside). 
Fatalities and major injuries will occur due to falling and crushing during the panic on the street, 
and due to vehicle accidents. 

Little direct damage due to the attack, except the building interiors and contents, will be highly 
contaminated by agent condensing on surfaces. The three buildings and their contents will be a 
total loss due to decontamination measures and/or psychological impacts of future usability. 
However, airing and washing should decontaminate adjacent structures adequately. 

Overwhelming demand will disrupt communications (landline telephone and cellular) in the 
local area. There will be large numbers of "worried well" swamping the medical system. Loss of 
three fire crews and three EMS crews will impact readiness for other events in the short term. 

Decontamination, destruction, disposal, and replacement of three large commercial office 
buildings could cost up to $300 million. Business in the buildings may never reopen, and an 
overall national economic downturn is possible in the wake of the attack due to loss of consumer 
confidence. 

Those who survive usually recover within 4 to 6 weeks, with full cholinesterase level restoration 
within 3 to 4 months. Patients who experience prolonged seizures may sustain permanent 
damage to the central nervous system. 
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Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis - 

Emergency Management/Response - 
Incident/Hazard Mitigation - 

Public Protection - 
Victim Care - 

Investigation/Apprehension - 

Recovery/Remediation - 



The ability to prevent the attack is contingent on the prevention of 
CWM importation, weapons assembly, and site reconnaissance. 

Rapid recognition of an attack will be key to avoiding first 
responder casualties. Actions required include dispatch; agent 
detection; and hazard assessment, prediction, monitoring, and 
sampling. 

Actions required include alerts, activation and notification, traffic 
and access control, protection of special populations, resource 
support and requests for assistance, and pubic information activities. 

Actions required include isolating and defining the hazard; 
establishing, planning, and operating incident command; preserving 
the scene; conducting mitigation efforts; decontaminating 
responders, and conducting site remediation and monitoring. 

Evacuation and/or sheltering of downwind populations will be 
required. 

Tens of thousands of persons will require monitoring and 
decontamination as they are allowed to leave their buildings. 
Hundreds will require hospital treatment. 

Tracking and apprehension of the suspects will be included. Actions 
required include suspect tracking and apprehension, dispatch, site 
control, criminal investigation, and tactical deployment. 

Anything exposed to a high-vapor agent concentration will require 
decontamination, including bodies. There will be little damage to the 
building as a direct result of the attack. However, decontamination 
of some materials may be difficult or impossible. Even if structures 
and property could be technically decontaminated, the psychological 
impact on future usability would be significant. 
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Scenario 8: Chemical Attack - Chlorine Tank Explosion 

Executive Summary 



Casualties 17,500 fatalities; 10,000 severe injuries; 100,000 

hospitalizations 
Infrastructure Damage In immediate explosions areas, and metal corrosion in 

areas of heavy exposure 



Evacuations/Displaced Persons Up to 70,000 (self evacuate) 



Contamination Primarily at explosion site, and if waterways are impacted 

Economic Impact Millions of dollars 

Potential for Multiple Events Yes 



Recovery Timeline Weeks 



Scenario Overview: 

General Description - 

Chlorine gas is poisonous and can be pressurized and cooled to change it into a liquid form so 
that it can be shipped and stored. When released, it quickly turns into a gas and stays close to the 
ground and spreads rapidly. Chlorine gas is yellow-green in color and although not flammable 
alone, it can react explosively or form explosive compounds with other chemicals such as 
turpentine or ammonia. 

In this scenario, the Universal Adversary (UA) infiltrates an industrial facility and stores a large 
quantity of chlorine gas (liquefied under pressure). Using a low-order explosive, UA ruptures a 
storage tank man- way, releasing a large quantity of chlorine gas downwind of the site. Secondary 
devices are set to impact first responders. 

Timeline/Event Dynamics — 

Total time to plan and prepare for the attack would be on the order of 2 years, including 
reconnaissance and weapons training, and accumulation of weapons. The actual infiltration, 
explosive charges setting, and ex-filtration would take less than 20 minutes. Except in very cold 
conditions, the release would be complete in less than an hour. The plume would travel 
downwind and be dispersed below the detection level in 6 hours. In order for the UA to succeed 
in this attack, certain meteorological conditions - wind speed, temperature, humidity, and 
precipitation - must be met. 
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Secondary Hazards/Events - 

Authorities will shelter-in-place a significant area downwind of the site. Numerous injuries will 
result from population panic once downwind casualties begin to occur, and as many as 10% of 
the people will self-evacuate. Additional injuries are likely, due to motor vehicle accidents in the 
surrounding roadways. The rule of thumb is one fatality per 10,000 evacuated. Any local 
waterways or wetlands will absorb the chlorine gas, creating hydrochloric acid and lowering the 
acidity (potential of hydrogen, or pH) of the water. 

Key Implications: 

Assuming a high-density area, as many as 700,000 people may be in the actual downwind area, 
which could extend as far as 25 miles. Of these, 5% (35,000) will receive potentially lethal 
exposures, and half of these will die before or during treatment. An additional 15% will require 
hospitalization, and the remainder will be treated and released at the scene by Emergency Medical 
Service (EMS) personnel. However, approximately 450,000 "worried well" will seek treatment at 
local medical facilities. 

The storage tank will be lost, along with some sensitive control systems damaged by the freezing 
liquefied gas. The secondary devices will cause damage to other plant facilities and equipment in 
a 20-meter radius of the blasts as well. There will be hundreds, if not thousands, of auto 
accidents during the evacuation. In areas of heavy chlorine exposure, there will also be heavy 
corrosion of metal objects. 

The plant will be temporarily closed due to bomb damage. Overwhelming demand will disrupt 
communications (landline telephone and cellular) in the local area. Significant disruptions in 
health care occur due to the overwhelming demand of the injured and the "worried well." 

Decontamination, destruction, disposal, and replacement of major portions of the plant could 
cost millions. The local economy will be impacted by a loss of jobs at the facility if it is unable 
to reopen. An overall national economic downturn is possible in the wake of the attack due to a 
loss of consumer confidence. 

Most of the injured will recover in 7 to 14 days, except for those with severe lung damage. These 
individuals will require long-term monitoring and treatment. 
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Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis - 

Emergency Management/Response - 
Incident/Hazard Mitigation - 



Public Protection - 
Victim Care - 

Investigation/Apprehension - 



Recovery/Remediation 



The ability to prevent the attack is contingent on the prevention of 
weapons acquisition, specifically IEDS, and site reconnaissance. 

The presence of secondary devices will complicate assessment and 
identification efforts. Actions required include dispatch; chlorine 
detection; and hazard assessment, prediction, monitoring, and 
sampling. 

Actions required include alerts, activation and notification, traffic 
and access control, protection of special populations, resource 
support and requests for assistance, and pubic information activities. 

Mitigation measures will be complicated by secondary device 
concerns (i.e., delayed detonation of IEDs). Actions required include 
isolating and defining the hazard; establishing, planning, and 
operating incident command; firefighting; conducting bomb disposal 
dispatch and IED render-safe procedures; preserving the scene; 
performing mitigation efforts; decontaminating responders; and 
conducting site remediation and monitoring. 

Evacuation and/or sheltering of downwind populations will be 
required. 

Injuries to be treated will include respiratory difficulty or severe 
distress and/or vehicular accident trauma. Short- and long-term 
treatment may be required. 

Searching for suspects and evidence in an industrial area while 
wearing personal protective equipment (PPE) will be a significant 
challenge. Actions required include dispatch, site control, criminal 
investigation, pursuit and tactical deployment, and apprehension of 
suspects. 

Since chlorine is a gas, the extent of decontamination required will 
be minor and largely related to any releases generated by secondary 
devices. Regardless, monitoring and sampling a large industrial 
facility will be a challenge. There will be significant damage to the 
plant as a direct result of the attack. Decontamination of waterways 
may present a significant challenge as well. Environmental impacts, 
especially public safety concerns, are likely to significantly delay 
rebuilding efforts. 
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Scenario 9: Natural Disaster - Major Earthquake 

Executive Summary 



Casualties 1,400 fatalities; 100,000 hospitalizations 



Infrastructure Damage 150,000 buildings destroyed, 1 million buildings damaged 

Evacuations/Displaced Persons 300,000 households 

Contamination From hazardous materials, in some areas 



Economic Impact Hundreds of billions 



Potential for Multiple Events Yes, aftershocks 



Recovery Timeline Months to years 



Scenario Overview: 

General Description - 

Earthquakes occur when the plates that form under the Earth's surface suddenly shift, and most 
earthquakes occur at the boundaries where the plates meet. A fault is a fracture in the Earth's 
crust along which two blocks of the crust have slipped with respect to each other. The magnitude 
of an earthquake, usually expressed by the Richter Scale, is a measure of the amplitude of the 
seismic waves. The intensity, as expressed by the Modified Mercalli Scale, is a subjective 
measure that describes how strong a shock was felt at a particular location. 

The Richter Scale is logarithmic so that a recording of 7, for example, indicates a disturbance 
with ground motion ten times as large as a recording of 6. A quake of magnitude 2 is the smallest 
quake normally felt by people. Earthquakes with a Richter value of 6 or more are commonly 
considered major; great earthquakes have magnitude of 8 or more. The Modified Mercalli (MM) 
Scale expresses the intensity of an earthquake's effects in a given locality in values ranging from 
I to XII. The most commonly used adaptation covers the range of intensity from the condition of 
"I - Not felt except by a very few under especially favorable conditions," to "XII - Damage 
total. Lines of sight and level are distorted. Objects thrown upward into the air." 

In this scenario, a 7.2-magnitude earthquake occurs along a fault zone in a major metropolitan 
area (MMA) of a city. MM Scale VIII or greater intensity ground shaking extends throughout 
large sections of the metropolitan area, greatly impacting a six-county region with a population 
of approximately 10 million people. Subsurface faulting occurs along 45 miles of the fault zone, 
extending along a large portion of highly populated local jurisdictions, creating a large swath of 
destruction. Soil liquefaction occurs in some areas, creating quicksand-like conditions. 

Timeline/Event Dynamics — 

While scientists have been predicting a moderate to catastrophic earthquake in the region 
sometime in the future, there were no specific indications that an earthquake was imminent in the 
days and weeks prior to this event. 
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Damage includes a large multi-state area of several hundred square miles. Rapid horizontal 
movements associated with the earthquake shift homes off their foundations and cause some tall 
buildings to collapse or "pancake" as floors collapse down onto one another. Shaking is 
exaggerated in areas where the underlying sediment is weak or saturated with water. (Note: In 
the central and eastern United States, earthquake waves travel more efficiently than in the 
western United States. An earthquake of a given size in the central and eastern United States may 
cause damage over a much broader area than the same size earthquake in California.) 

Several hours later, an aftershock of magnitude 8.0 occurs. Based on past events, additional 
aftershocks are possible. Sizeable aftershocks (7.0 to 8.0 in magnitude) may occur for months 
after the original jolt. 

Secondary Hazards/Events - 

As a result of the earthquake, hazardous contamination impacts of concern include natural gas 
compression stations and processing plants, oil refineries and major tank farms, and natural 
gas/crude oil pipelines. In addition, more than 2,000 spot fires occur and widespread debris 
results. Flooding may occur due to levee failures and breaks in water mains and sewage systems. 

Transportation lines and nodes; power generation and distribution; communications lines; fuel 
storage and distribution; and various structures (ranging from dams to hospitals) may be 
damaged and will require damage assessment in order to continue operating. Reduced 
availability of services will be disruptive and costly. 

Ground shaking from the earthquake has generated massive amounts of debris (more than 120 
million tons) from collapsed structures. In addition, fuel pumps in several gas stations have 
sustained damages, leaking thousands of gallons of gasoline into the streets. There are numerous 
reports of toxic chemical fires, plumes with noxious fumes, and spills. Several other local waste 
treatment facilities have reported wastewater and sewage discharges. A large refining spill has 
contaminated the port facility and is spilling into the harbor. Significant concern for spilled 
hazardous materials from storage, overturned railcars, and chemical stockpiles make progress 
very slow as triage is conducted. 

Key Implications: 

Approximately 1,400 fatalities occur as a direct result of the earthquake. More than 100,000 
people are injured and continue to overwhelm area hospitals and medical facilities, most of 
which have sustained considerable damage. Approximately 18,000 of the injured require 
hospitalization. As many as 20,000 people are missing and may be trapped under collapsed 
buildings and underground commuter tunnels. 

More than 1 million buildings were at least moderately damaged (40% of the buildings) and 
more than 150,000 buildings have been completely destroyed 

Service disruptions are numerous to households, businesses, and military facilities. Medical 
services are overwhelmed and functioning hospitals are limited. Fire and Emergency Medical 
Services (EMS) stations and trucks were also damaged. Bridges and major highways are down or 
blocked and damaged runways have caused flight cancellations. There are widespread power 
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outages and ruptures to underground fuel, oil, and natural gas lines. Water mains are broken. 
Wastewater primary receptors have broken, closing down systems and leaking raw sewage into 
the streets. As a result, public health is threatened. 

More than 300,000 households have been displaced, and many businesses have lost employees 
and customers. The port has been adversely affected in its capacity to provide export/import and 
loading/unloading capabilities, and damage to vital parts of the communications infrastructure 
has resulted in limited communications capabilities. 

The disruption to the nation's economy could be severe because the earthquake impacts major 
supply and transportation centers. Reconstruction, repairs, disposal, and replacement of lost 
infrastructure will cost billions of dollars. Replacement of lost private property and goods could 
also cost billions. An overall national economic downturn is probable in the wake of this event. 



Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis 



Emergency Management/Response - 



Incident/Hazard Mitigation - 

Public Protection - 
Victim Care - 

Investigation/Apprehension - 
Recovery/Remediation - 



After the earthquake occurs, actions should be taken to protect 
critical facilities from terrorist attacks and to maintain civil order. 

Disaster assessments and aerial reconnaissance are necessary. Using 
real-time seismic data, the Federal Emergency Management Agency 
(FEMA) runs an earthquake model to provide a preliminary "best 
guess" at the level of expected damage, subject to confirmation or 
modification through remote sensing and field assessments. 
Assessment teams must be deployed and remote sensing initiated. 

Hazardous material spills must be managed. Emergency medical 
treatment, shelters, and food must be provided. A Joint Information 
Center (JIC) is established, and search and rescue teams must be 
place don alert, some of which should be activated and deployed. 
Public utilities and other basic-needs services must be repaired as 
quickly as possible, and damage assessments should be conducted. 

Federal support will be required to coordinate the development of 
plans to execute mitigation efforts to lessen the effects of future 
disasters. Mitigation to minimize or avoid future impacts would 
largely be an issue for recovery and restoration. 

Structural engineers are inspecting critical building, bridge, freeway, 
waste facilities, etc., and inspection teams are deployed to inspect 
hundreds of homes for safe habitability. 

The massive number of injured and displaced persons requires a 
warning order for the activation of Task Forces for the delivery of 
mass care and health and medical services. Temporary housing 
strategies must be considered. 

Not applicable (natural disaster). 

Hazardous materials will contaminate many areas, and 
decontamination and site restoration will be a major challenge. 
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Scenario 10: Natural Disaster - Major Hurricane 

Executive Summary 



Casualties 


1,000 fatalities, 5,000 hospitalizations 


Infrastructure Damage 


Buildings destroyed, large debris 


Evacuations/Displaced Persons 


1 million evacuated; 100,000 homes seriously 


damaged 


Contamination 


From hazardous materials, in some areas 


Economic Impact 


Millions of dollars 


Potential for Multiple Events 


Yes, seasonal 


Recovery Timeline 


Months 



Scenario Overview: 

General Description - 

Hurricanes are intense tropical weather systems consisting of dangerous winds and torrential 
rains. Hurricanes often spawn tornadoes and can produce a storm surge of ocean water that can 
be up to 24 feet at its peak and 50 to 100 miles wide. The most destructive companion of 
hurricanes is the storm surge. 

A typical hurricane is 400 miles in diameter and has an average forward speed of 15 miles per 
hour (mph) in a range of to 60 mph. The average life span of a hurricane is 9 days in a range of 
less than 1 day to more than 12 days. Hurricanes' highest wind speeds are 20 to 30 miles from 
the center. Hurricane force winds cover almost 100 miles, and gale-force winds of 40 mph or 
more may cover 400 miles in diameter. A fully developed hurricane may tower 10 miles into the 
atmosphere. 

A hurricane is categorized by its sustained wind intensity on a Saffir-Simpson Hurricane Scale 
that is used to estimate the potential for property damage and flooding. "Major" hurricanes are 
placed in Categories 3, 4, or 5 with sustained wind intensities between 111 mph to greater than 
155 mph. The most dangerous potential storm would be a slow-moving Category 5 hurricane, 
making landfall in a highly populated area. 

In this scenario, a Category 5 hurricane hits a Major Metropolitan Area (MMA). Sustained winds 
are at 160 mph with a storm surge greater than 20 feet above normal. As the storm moves closer 
to land, massive evacuations are required. Certain low-lying escape routes are inundated by 
water anywhere from 5 hours before the eye of the hurricane reaches land. 

Timelines/Event Dynamics - 

A tropical storm develops in the Atlantic and is upgraded to a hurricane after 5 days in the open 
waters. After 4 days, the hurricane has steadied at dangerous Category 4 level on the Safir- 
Simson Hurricane Scale and models indicate a track that includes a possible landfall along the 
coast adjacent to the MMA within 2 more days. The hurricane reaches its peak as predicted and 
makes landfall with a direct hit on the MMA and coastal resort towns. The next day the hurricane 
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moves out. The rain associated with the storm has caused rivers to overflow their banks, and 
several rivers systems are experiencing record flood levels. 

Secondary Hazards/ Events - 

In addition to the massive destruction caused by the hurricane itself, there are also areas within 
the MMA and scattered inland areas that have sustained severe damage from tornadoes that were 
generated by the storm. Storm surges and heavy rains cause catastrophic flooding to low lying 
areas. Rainfall from the hurricane, in combination with earlier storms, causes significant flooding 
in multiple states along the coast. 

Flooded and damaged petrochemical facilities, chemical plants, sewage treatment plants, and 
other facilities threaten the health of citizens, create a hazardous operating environment, and 
require cleanup and remediation. An oil tanker is blown off course during the storm and sustains 
serious damage and leaks oil into the waters adjacent to the MMA. 

Key Implications: 

The hurricane results in more than 1,000 fatalities, and 5,000 thousand people have sustained 
injuries requiring professional treatment. Tourists and residents in low-lying areas were ordered 
to evacuate 48 hours prior to projected landfall. Twenty-four hours prior to predicted landfall 
massive evacuations were ordered, and evacuation routes have been overwhelmed. 

Major portions of the MMA become flooded. Structures in the low-lying areas are inundated 
when storm surges reach their peak. Many older facilities suffer structural collapse due to the 
swift influx of water and degradation of the supporting structural base. Newer facilities and 
structures survive the influx of water, but sustain heavy damage to contents on the lower levels. 

Most all shrubbery and trees within the storm's path are damaged or destroyed, generating 
massive amounts of debris. Debris is also generated from structures destroyed from tornadoes 
and structures that have been destroyed or damaged by the hurricane. Many structures will need 
to be demolished. 

Service disruptions are numerous. Shelters throughout the region are also filled to capacity. 
Hundreds of people are trapped and require search and rescue. Until debris is cleared, rescue 
operations are difficult because much of the area is reachable only by helicopters and boats. 
Wind and downed trees have damaged nearly all of the electric transmission lines within the 
MMA. Most communications systems within the impacted area are not functioning due to 
damage and lack of power. 

Thousands are homeless, and all areas are in serious need of drinking water, and food is in short 
supply and spoiling due to lack of refrigeration. Sewage treatment plants in the region have been 
flooded and sustained damaged from the storm. Factories, chemical plants, sewage treatment 
plants and other facilities in the MMA have suffered severe damage. Hundreds of thousands of 
gallons of extremely hazardous substances have spilled into the floodwaters. There is also 
gasoline, diesel fuel, and oil leaking from underground storage tanks. A 95,000-ton tanker struck 
a bridge, breaching the hull of the vessel, which then began to leak oil into waters adjacent to the 
MMA. All of these issues threaten public health. 
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Many businesses have experienced damage to buildings and infrastructure as well as lost 
employees and customers. Military facilities are damaged, and assistance is needed to provide 
for the military community and to reconstitute the facilities. The 20-foot storm surge has 
breached and overtopped flood control and hurricane protection works. All transportation routes 
are damaged to some degree, and the port facility has also been adversely affected. Many 
hospitals have sustained severe damage and those that are open are overwhelmed. Schools that 
are not severely damaged are being used as shelters for the disaster victims. Thousands of pets, 
domesticated animals, and wild animals have been killed or injured, and officials have been 
overwhelmed with requests for assistance in finding lost pets. 

There are severe economic repercussions for the whole state and region. The impact of closing 
the port ripples through the country. The loss of the petro-chemical supplies could raise prices 
and increase demand on foreign sources. 



Mission Areas Activated: 

Prevention/Deterrence/Protection 



Emergency Assessment/Diagnosis - 



Emergency Management/Response - 



Incident/Hazard Mitigation 



Public Protection 



Victim Care - 

Investigation/Apprehension 
Recovery/Remediation - 



As the storm approaches, state and local governments are given 
increasingly accurate forecasts and assessments of possible impacts. 
Forecasters have difficulty predicting the intensity of the storm prior 
to landfall, but urge officials to prepare for the worst. State and 
locals have time to execute evacuation plans. 

Assessment is required for infrastructure, rapid needs, search and 
rescue, health and medical, and navigation. Remote sensing and 
modeling help determine the extent of the damages. 

Some of the response actions require include search and rescue 
operations, mortuary services and victim identification, medical 
system support, debris clearance and management, temporary 
emergency power, transportation infrastructure support, 
infrastructure restoration, and temporary roofing. 

Support is required to coordinate the development of plans to 
execute mitigation efforts that lessen the effects of future disasters. 
This includes studies to assess flood and coastal erosion and 
intergovernmental plans to mitigate future damages. 

Measures need to be taken to control vectors that may thrive in the 
areas after a catastrophic hurricane. Support will be required to 
maintain law and order and to protect private property. Support will 
be required to test and analyze health and safety hazards and 
implement measures to protect the public. 

Care must include medical assistance; shelter and temporary housing 
assistance; emergency food, water, and ice provision; and sanitary 
facility provision. 

Not applicable (natural disaster). 

Hazardous materials will contaminate many areas, and 
decontamination and site restoration will be a major challenge. 



10-3 



Version 2.0 



Scenario 11: 
Radiological Attack - Radiological Dispersal Devices 

Executive Summary 



Casualties 


180 fatalities; 270 injuries; 20,000 detectible 
contaminations (at each site) 


Infrastructure Damage 


Near the explosion 


Evacuations/Displaced Persons 


Yes 


Contamination 


36 city blocks (at each site) 


Economic Impact 


Up to billions of dollars 


Potential for Multiple Events 


Yes 


Recovery Timeline 


Months to years 



Scenario Overview: 

General Description - 

Cesium-137 ( ! 7 Cs) has a half-life of 33 years. It decays by both beta and gamma radiation. It is 
one of several known radioactive isotopes that stand out as being highly suitable for radiological 
terror. This isotope causes skin damage similar to burns, but the injury may be as deep within the 
body as on the skin. Cesium would be particularly dangerous if accidentally ingested or inhaled, 
even in small quantities. Cesium mimics potassium in the body. It binds to concrete and other 
masonry, making decontamination of such buildings extremely difficult and possibly 
economically infeasible. Use of 137 Cs in an urban setting would seriously raise the cost of 
cleanup. 

1 37 

Cs is mostly used in the form of cesium chloride (CsCl), because it is easy to precipitate. CsCl 
is a fairly fine, light powder with typical particle size median at about 300 microns. Fractions 
below 10 microns are typically less than 1%. In a Radiological Dispersal Device (RDD), most 
will fall out within approximately 1 to 2,000 feet (although many variables exist), but a small 
amount may be carried great distances, even hundreds of miles. 

In this scenario, the Universal Adversary (UA) purchases stolen CsCl to make an RDD or "dirty 

I 37 

bomb." The explosive and the shielded Cs sources are smuggled into the country. Detonator 
cord is stolen from a mining operation, and all other materials are obtained legally in the United 
States. Devices are detonated in three separate, but regionally close, moderate-to-large cities. The 
cities are physically similar with geographic topography that is flat. The results in each city are 
essentially the same. The contaminated region covers approximately thirty-six blocks in each 
city and includes the business district (high-rise street canyons), residential row houses, crowded 
shopping areas, and a high school. Buildings in the affected areas are principally made of 
concrete and brick; some are stone faced. 

1 37 

The entire scene is contaminated with Cs, though not at levels causing immediate concern to 
first responders. Due to the size of the explosion, the radioactive contamination is blown widely 
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such that the ground zero area is not as radioactive as might have been expected. The detonation 
aerosol contains 90% of the original 137 Cs source with radioactive particles whose sizes range 
from 1 micron (or micro-meter, urn) to 150 microns - the size of most of the particles is 
approximately 100 microns. Larger particles either penetrate building materials in the blast zone, 
or drop quickly to the ground as fall-out within about 500 feet. 

Variable winds of 3 to 8 miles per hour carry the radioactively contaminated aerosol throughout 
an area of approximately thirty-six blocks (the primary deposition zone). Complex urban wind 
patterns carry the contamination in unpredictable directions, leaving highly variable 
contamination deposition with numerous hot spots created by wind eddies and vortices. 
Radioactivity concentrations in this zone are on the order of 5-50 microui/m 2 , with hot spots 
measuring 100-500 microui/m 2 ; however, traces of the 137 Cs plume carry more than 3.5 
kilometers (~ 2.2 miles) on prevailing winds. Air intakes contaminate interiors of larger 
buildings, and negative indoor building pressure draws contaminated aerosol into buildings via 
cracks around windows and doors. In city one, the subway air intakes contaminate the subway 
system. 

Timeline/Event Dynamics — 

The attacks have no advance notice or intelligence that indicates their possibility. The explosions 
are instantaneous, but plume dispersion continues for 20 minutes while breezes navigate the 
complex environments before particles have fully settled. First responders do not recognize 
radioactive contamination for 15 minutes in city one. The explosions in cities two and three are 
promptly identified as "dirty bombs" - this provides some advantage to first responders and 
government officials in managing contamination on-scene, and in communicating with the public 
concerning topical contamination and spread of contamination. 

Secondary Hazards/Events - 

Small fires from ruptured gas lines occur in the vicinity of the blasts. Unstable building facades, 
rubble, and broken glass create physical hazards for rescue workers. Small amounts of lead, 
asbestos, and Polychlorinated Biphenyls (PCBs) are present in the air and on surfaces. Human 
remains present a biohazard, and some of these are very radioactive. 

Key Implications: 

At each site, the blast results in 180 fatalities and about 270 injured requiring medical care. In 
addition, up to 20,000 individuals in each primary deposition zone potentially have detectable 
superficial radioactive contamination. 

In each blast, one building and twenty vehicles are destroyed, and eight other buildings suffer 
varying degrees of damage, such as minor structural damage and broken windows. Radioactive 
contamination is found inside and outside of buildings over an area of approximately thirty-six 
blocks in each city. Minor contamination may be an issue further downwind as investigators 
perform more thorough surveys. Most of the subway system in city one is contaminated. 

Over the long term, decontamination efforts are expected to be effective, but some property 
owners choose demolition and rebuilding. Many square blocks will be unavailable to businesses 
and residents for several years until remediation is completed. 



11-2 



Version 2.0 



Transportation is severely hampered in each city. Bus, rail, and air transport routes are altered, 
and officials build highway checkpoints to monitor incoming traffic for contamination. The 
subway system in city one is completely closed for an extended period. Hospitals in each region, 
already at maximum capacity with injuries from the blasts, are inundated with up 50,000 
"worried well." 

The sewage treatment plant is quickly contaminated. Seventy-five businesses are closed for an 
extended duration while radioactive contamination is remediated. Local tax revenues plummet, 
and people discover that insurance claims are rejected. The schools in the contamination zones 
are closed and students meet in alternate locations. Nearby towns and cities close their doors to 
residents of the impacted cities for fear of contamination spread. 

Decontamination, destruction, disposal, and replacement of lost infrastructure will be costly (i.e., 
hundreds of millions of dollars per site). The entire contaminated area may be economically 
depressed for years. An overall national economic downturn may occur in the wake of the attack 
due to a loss of consumer confidence. 

In the long term, no one will suffer acute radiation syndrome, but approximately 20,000 
individuals are likely to become externally contaminated at each site. Low-level contamination 
may enter food and water supplies. The sum of the cumulative exposures results in an increased 
lifetime cancer risk proportionate to the dose. Mental health services will be required. 
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Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis - 
Emergency Management/Response - 



Incident/Hazard Mitigation - 



Public Protection - 



Victim Care 



Investigation/Apprehension 



Recovery/Remediation 



Efforts should include prevention of trafficking and importation of 
CsCl and weapon components, detection of the plot, reconnaissance 
of the site, protection, and deterrence measures. 

First responders are likely to be contaminated. The downwind 
aerosol dispersion will be a significant component of the hazard. 
Assessment and coordination efforts required are numerous. 

Actions required include mobilizing and operating incident 
command; overseeing victim triage; stabilizing the site; cordoning 
the site and managing and controlling the perimeter; providing 
notification and activation of special teams; providing traffic and 
access control; providing protection of at-risk and special 
populations; providing resource support and requests for assistance; 
providing public works coordination; providing direction and 
control of critical infrastructure mitigation; and providing pubic 
information, outreach, and communication activities. 

Actions required include isolating the incident scene and defining 
the hazard areas, building stabilization, providing fire suppression, 
conducting debris management and radioactive and hazardous 
contamination mitigation, decontaminating responders and 
equipment as well as local citizens, and conducting local site 
contamination control. 

Sheltering and/or evacuation of downwind populations will be 
required and must occur quickly. Protection actions required range 
from developing protective action recommendations and 
communicating them to the public to making radio-protective 
pharmaceutical decisions and efficiently distributing drugs. 

Injured people will require some decontamination in the course of 
medical treatment and, if possible, prior to hospital admission. 
Thousands more will likely need superficial decontamination, and 
both short-term and long-term medical follow-ups. 

Actions required include dispatching personnel, conducting site 
cordoning and control, collecting field data and witness interviews, 
and performing tactical deployment and apprehension of suspects. 
Reconstruction of the attack should occur. 

The extent of contamination will be a major challenge because 137 Cs 
is highly water-soluble and is chemically reactive with a wide 
variety of materials, including common building materials such as 
concrete and stone. Several buildings (those most damaged) will be 
torn down and eventually rebuilt. Decontamination activities are 
undertaken for building exteriors and interiors, streets, sidewalks, 
and other areas. 
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Scenario 12: Explosives Attack - 
Bombing Using Improvised Explosive Device 

Executive Summary 



Casualties 


100 fatalities; 450 hospitalizations 


Infrastructure Damage 


Structures affected by blast and fire 


Evacuations/Displaced Persons 


Minimal 


Contamination 


None 


Economic Impact 


Local 


Potential for Multiple Events 


Yes 


Recovery Timeline 


Weeks to months 



Scenario Overview: 

General Description - 

In this scenario, agents of the Universal Adversary (UA) use improvised explosive devices 
(IEDs) to detonate bombs inside a sports arena and create a large vehicle bomb (LVB). They also 
use suicide bombers in an underground public transportation concourse and detonate another 
bomb in a parking facility near the entertainment complex. An additional series of devices is 
detonated in the lobby of the nearest hospital emergency room (ER). 

The event is primarily designed for an urban environment, but could be adapted for more rural 
area events such as county fairs and other large gatherings. Casualty estimates would be reduced 
as a function of a reduced target population and less population density at target points. 

Timeline/Event Dynamics- 

The fire is ignited approximately 1 hour after the start of the entertainment event. The detonation 
of explosives is delayed approximately 10 to 15 minutes after the ignition of the fire in order to 
allow for detection, evacuation, and response of emergency services providers. The detonation of 
explosives at the hospital site will be the hardest to time for maximum effect and may need to be 
coordinated by some communication among cell members. In any case, the hospital device 
should be detonated before the arrival of casualties from the entertainment venue. 

The timing of some of these events, with the exception of the evacuation stimulus, is not critical. 
The more people who evacuate the venue, the more potential explosives-related casualties are 
produced. If evacuation of the venue is delayed, the fire and detonation of the LVB near the 
venue can be expected to produce increased casualties inside the structure due to collapse, 
secondary and tertiary blast effects, increased exposure to products of combustion, thermal 
effects, and crowd surge. 

Secondary Hazards/Events - 

Secondary hazards include the disruption of electric power, natural gas lines, and water mains - 
the disruption will cause undermining of streets and flooding of underground transit ways. There 
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may be toxic smoke resulting from fires and explosions. There will be loss of traffic controls in 
the area, and fleeing citizens would likely cause traffic accidents. Media response to the area 
may affect responders. Since one of the bombs was disguised as an emergency response vehicle, 
other "legitimate" vehicles may be impeded in their response to the scene and hospitals. 

Key Implications: 

Casualties will result at all five incident sites and will include civilians, emergency personnel, 
and the suicide bombers. The LVB detonation outside the venue can be expected to result in the 
largest number of fatalities and injuries due to the "population density" expected. Fatalities and 
injuries are summarized in Table 12-1. 



Incident or Location 


Fatalities 


Serious Injuries 


Fire 


8 


150 


Large Vehicle Bomb 


35 


200 


Car bomb 


7 


40 


Transportation center 
(subway) 


8 


50 


Hospital 


8 


40 



Table 12-1. Summary of fatalities and serious injuries as a result of the bombings 



Property damage would include severe fire and blast damage to the entertainment venue, blast 
damage to buildings across from the entertainment venue, moderate damage to the transportation 
center, severe damage to vehicles and nearby buildings at the parking facility, and severe damage 
to the hospital ER. 

Service disruption would be severe in the impacted city and would include traffic (especially the 
subway), public transportation, emergency services, and hospitals. The local economic impact 
includes loss of use of the entertainment venue for a period of 1 year during the repair of fire and 
blast damage. 

Major health issues include severe burn treatment and therapy for the victims; permanent hearing 
loss; long-term tinnitus; vertigo for some exposed to the blast; and post-traumatic stress for 
victims, first responders, and nearby residents. 
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Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis - 
Emergency Management/Response - 



The planning and execution of this event would require a significant 
level of relatively unsophisticated coordination. As such, the 
potential for detection in the pre-event planning stages exists. 

The fire would be the first recognizable indication that the attack 
was under way. Actions required include dispatch; agent detection; 
and hazard assessment, prediction, monitoring, and sampling. 

Actions required include search and rescue, alerts, activation and 
notification, traffic and access control, protection of special 
populations, resource support, requests for assistance, and public 
information. Establishment of a Joint Operations Center (JOC) is 
required. 

Primary hazards include fire; toxic atmosphere/smoke; un-detonated 
explosives; unstable structures; electrical hazards; and low visibility. 
Hospital personnel must ensure that arriving vehicles are not 
delivery systems for additional weapons. 

Evacuation is required as well as additional threat assessment. The 
area must be cordoned. 

Injuries range from "walking wounded" to multiple systems trauma, 
burns, and obvious fatalities. Elimination of the ER facility at the 
target hospital will force other facilities to receive all patients from 
the entertainment venue blasts. 

Investigation can begin during the rescue phase with photo 
documentation of the immediate scene, victim locations, and injury 
patterns. Coordination of federal, state, and local investigative 
resources will begin early in the incident management. 

Decontamination is necessary for blood-borne pathogens at all sites. 
Debris removal must occur after evidence search and recovery. 
Restoration of the main venue could take more than 1 year 
(depending on the extent of the fire damage). Repair and restoration 
of the transportation center can be estimated at 4 months. 



Note: The full-text version of this document contains overpressure templates and calculations, as 
well as tables outlining human injury and property damage criteria for various levels of blast 
overpressure. 



Incident/Hazard Mitigation - 

Public Protection - 
Victim Care - 

Investigation/Apprehension - 

Recovery/Remediation - 
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Scenario 13: Biological Attack- Food Contamination 

Executive Summary 



Casualties 


300 fatalities; 400 hospitalizations 


Infrastructure Damage 


None 


Evacuations/Displaced Persons 


None 


Contamination 


Sites where contamination was dispersed 


Economic Impact 


Millions of dollars 


Potential for Multiple Events 


Yes 


Recovery Timeline 


Weeks 



Scenario Overview: 

General Description - 

The U.S. food industry has significantly increased its physical and personnel security since 2001. 
A successful attack could only occur following the illegal acquisition of sensitive information 
revealing detailed vulnerabilities of a specific production site. However, in this scenario the 
Universal Adversary (UA) is able to acquire these restricted documents due to a security lapse. 
The UA uses these sensitive documents and a high degree of careful planning to avoid 
apprehension and conduct a serious attack. 

The UA delivers liquid anthrax bacteria to pre-selected plant workers. At a beef plant in a west 
coast state, two batches of ground beef are contaminated with anthrax, with distribution to a city 
on the west coast, a southwest state, and a state in the northwest. At an orange juice plant in a 
southwestern state, three batches of orange juice are contaminated with anthrax, with distribution 
to a west coast city, a southwest city, and a northwest city. 

Timeline/Event Dynamics — 

• November: The biological agent is delivered to terrorists (plant workers). 

• December 3: The biological agent is inserted into ground beef and orange juice at 
production facilities, and the packages are shipped to affected cities. 

• December 5: The first signs of patients with unknown illness appear. 

• December 5-15: There is a significant influx of affected individuals into hospitals with 
1,200 sick, 300 dead, and 400 hospitalized in ICU. 

• December 8: Health departments, the CDC, the FDA, and the USDA begin pursuing 
epidemiological investigations. 

• December 30: A contaminated product trace is made to ground beef and orange juice 
production plants. Decontamination of plants commences. 

• January 5: No new cases of illness are reported. 
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Secondary Hazards/Events - 

As a result of news of the contaminated food products, there is general public concern regarding 
food safety, and the "worried well" are taxing medical and laboratory facilities. The public 
floods into medical facilities seeking prescription drugs to prevent or recover from sickness. In 
addition, ground beef and orange juice sales plummet, and unemployment in these two industries 
rises dramatically. 

Key Implications: 

The attack results in 300 fatalities, 400 hospitalizations, and 1,200 illnesses. Overall property 
damage is moderate, and due only to decontamination of affected facilities. However, property 
and facility disruption (downtime) are significant due to decontamination of affected facilities. 

Service disruption is significant in ground beef and orange juice industries, and some moderate 
disruption occurs in other food industries due to the public's concern about food safety in 
general. 

Although direct financial impact is significant, initial economic impact on the general economy 
is relatively low. However, the long-term financial impact on the beef and orange juice 
marketplace and associated businesses could be significant, and other food industries' income is 
likely to be negatively affected by the public's overall perception of unsafe food. The societal 
impact of attacks on the food supply generates demands for increased, costly, federally directed 
food security programs and other measures to reduce the possibility of future attacks. 

Anthrax may result in fatality and serious long-term illness. 
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Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis - 
Emergency Management/Response - 
Incident/Hazard Mitigation - 
Public Protection - 

Victim Care - 

Investigation/Apprehension - 
Recovery/Remediation - 



Avoiding the attack is contingent on the prevention of infiltration of 
two different food production systems. Deterrence and protection 
require rapid disease diagnosis, and protective measures to assure 
food safety. 

Determining cause of illness and tracking the contaminated source is 
critical. 

Disease outbreaks in three cities spread throughout the country, 
which tests coordination of resources. 

Once disease outbreak occurs, decisions must be made regarding 
meat and juice supplies and production. 

Public protection will require testing alert and warning mechanisms, 
providing public information and education, and coordinating 
human and veterinary services. 

Victim care will require diagnosis and treatment of affected 
population and distribution of prophylaxis for potentially exposed 
populations. 

Epidemiology will be critical to trace the source of contamination. 
Investigation of crime and apprehension of suspects will be needed. 

Contaminated foodstuffs require disposal. Plants and sites where 
anthrax was dispersed may need to be decontaminated. 
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Scenario 14: Biological Attack - 
Foreign Animal Disease (Foot & Mouth Disease) 

Executive Summary 



Casualties 


None 


Infrastructure Damage 


Huge loss of livestock 


Evacuations/Displaced Persons 


None 


Contamination 


None 


Economic Impact 


Hundreds of millions of dollars 


Potential for Multiple Events 


Yes 


Recovery Timeline 


Months 



Although this scenario depicts an intentional attack on the U.S. livestock industry, the accidental 
importation of certain diseases is also a hazard. 

Scenario Overview: 

General Description - 

Foot and mouth disease is an acute infectious viral disease that causes blisters, fever, and 
lameness in cloven-hoofed animals such as cattle and swine. Pregnant animals often abort and 
dairy cattle may dry up. It spreads rapidly among such animals and can be fatal in young 
animals. The disease is not considered a human threat. 

In this scenario, members of the Universal Adversary (UA) enter the United States to survey 
large operations in the livestock industries. The UA targets several locations for a coordinated 
bioterrorism attack on the agricultural industry. Approximately two months later, UA teams enter 
the United States and infect farm animals at specific locations. 

The U.S. livestock transportation system is highly efficient and movements are rapid and 
frequent. Although the initial event will be localized at transportation facilities in several states, 
as the biological agent matures and the livestock are transported, the geographical area will 
widen to include surrounding states where the livestock are delivered. 

Timelines/Event Dynamics - 

The foreign animal disease (FAD) is initially detected using clinical signs and veterinary medical 
detection and identification. Over a period of approximately 2 weeks, federal, state, and local 
animal health professionals put in place surveillance, detection, containment, remediation, and 
disposal protocols. This is followed by surveillance, detection, containment, remediation, and 
disposal protocols continue until testing confirms the FAD is eradicated. 
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Secondary Hazards/Events - 

Environmental issues regarding contaminated land and equipment must be seriously considered 
and addressed. Disposal of carcasses of culled animals must be done in an environmentally 
conscious and expeditious manner. 

Key Implications: 

There are no human fatalities or injuries. However, massive numbers of affected livestock are 
disposed of because the United States has a national policy not to vaccinate. Property damage 
will be limited to land mass required for disposal of euthanized livestock (burial). 

All transportation into and out of the affected areas will be severely limited to prevent further 
dispersion of the FAD to unaffected areas. Both commercial and private/personal travel will be 
limited. 

The extent of economic impact will depend on the ability to limit the geographical spread of the 
outbreak. A great economic impact will be realized in many sectors of the economy, including 
but not limited to agriculture. Long-term issues will be centered mostly on foreign trade. 

Economic factors will include the value of the affected livestock that must be disposed of; the 
cost of federal, state, and local governments to identify, contain, and eradicate the FAD; the cost 
of disposal and remediation; the loss of revenue suffered by the commercial transportation 
industry; the loss of revenue suffered by the retail industry due to public perception that the FAD 
poses a disease risk; the loss of export markets immediately upon confirmation that the FAD 
exists; and the cost to renew the livestock lost to euthanasia. 

The inevitable development and utilization of new technologies to include rapid detection, 
improved traditional vaccines/advanced molecular vaccines, and new therapeutics (including 
antiviral agents and other novel biomedical approaches) will lead to a physiological "hardening" 
of the U.S. farm animal population against FADs, thereby making them unattractive targets of 
bioterrorism. Although psychological impacts will be realized, human health issues will not be a 
consideration if a farm animal disease-causing agent is used. 
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Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis - 
Emergency Management/Response - 



Incident/Hazard Mitigation 



Public Protection 



Victim Care 



Investigation/Apprehension - 



Recovery/Remediation - 



The full force of the agricultural disease protection system will be 
challenged in order to prevent or detect further attacks. 

Investigations using epidemiological trace-back, microbial forensics, 
and other approaches will be utilized to determine the source of the 
agent and identity of the perpetrators. 

If the scope of the outbreak grows, the ability to effectively conduct 
intrastate and interstate command and control activities, as well as 
the ability to successfully allocate resources, will be a challenge. 
States would have a need for containment, federal funding and 
personnel, and the use and availability of the National Guard. 
Federal mobilization based on the National Response Plan. Evoking 
the Stafford Act would be considered. 

The halt of national movement of susceptible animals may be 
necessary. Equitable indemnification and when to begin 
reconstitution of the herds leading to economic recovery will be a 
major consideration. 

Information must be provided in order to combat the public's fear 
and the spread of misinformation about the disease. 

It will be necessary to euthanize and dispose of infected and exposed 
animals. 

Investigation and apprehension will entail a criminal investigation, 
involving law enforcement and agricultural experts. 

Ranches, feedlots, transportation modes, and other locations will 
require decontamination and cleanup. Cleaning and disinfecting are 
tools used to impede the spread of pathogenic microorganisms. All 
premises should be cleaned and disinfected under supervision of a 
regulatory animal health employee. 
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Scenario 15: Cyber Attack 

Executive Summary 



Casualties 


None directly 


Infrastructure Damage 


Cyber 


Evacuations/Displaced Persons 


None 


Contamination 


None 


Economic Impact 


Millions of dollars 


Potential for Multiple Events 


Yes 


Recovery Timeline 


Weeks 



Scenario Overview: 

General Description - 

In this scenario, the Universal Adversary conducts cyber attacks that affect several parts of the 
nation's financial infrastructure over the course of several weeks. Specifically, credit-card 
processing facilities are hacked and numbers are released to the Internet, causing 20 million 
cards to be cancelled; automated teller machines (ATMs) fail nearly simultaneously across the 
nation; major companies report payroll checks are not being received by workers; and several 
large pension and mutual fund companies have computer malfunctions so severe that they are 
unable to operate for more than a week. Individually, these attacks are not dangerous - but 
combined, they shatter faith in the stability of the system. Citizens no longer trust any part of the 
U.S. financial system and foreign speculators make a run on the dollar. 

Timelines/Event Dynamics - 

Several years are needed for preparation. The attack is executed over a few weeks to ensure 
extended press coverage and undermine confidence in the financial system. However, there are 
no secondary hazards/events. 

Key Implications: 

No fatalities, significant injuries, or property damage are expected. However, significant 
disruptions across many or most sectors of the financial industry do occur. The greatest impact of 
this event will be on the economy. 
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Mission Areas Activated: 

Prevention/Deterrence/Protection - 

Emergency Assessment/Diagnosis - 
Emergency Management/Response - 

Incident/Hazard Mitigation - 
Public Protection - 
Victim Care - 

Investigation/Apprehension - 



The strength of private sector finance companies will be tested in 
regard to prevention, deterrence, and protection. 

The attack will be difficult to recognize. Initially, failures may be 
mistaken for normal malfunctions, and analysis will have to be 
performed to link failures across many parts of the financial sector. 

Emergency response will be split between (1) technically bringing 
systems back online and instituting business continuity process, and 
(2) controlling the public perception of the situation to restore 
confidence and prevent panic. 

None. 

None. 

Citizens and investors will look for government assurances that their 
losses will be made whole. 

Using intelligence and law enforcement sources and methods, the 
investigators will need to determine the likely technical source and 
the identity of the perpetrators. 
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APPENDIX: Scenario Working Group Members 



The Homeland Security Council receives interagency guidance via a number of Policy 
Coordinating Committees (PCCs). One of them is the Domestic Threat, Response, and Incident 
Management (DTPJM) PCC; the Scenarios Working Group (SWG) supports the DTRIM. The 
members of the SWG are as follows: 

CHAIR: Janet K. Benini, Director of Response and Planning, White House 
Homeland Security Council 



Arkin, Richard 
Avato, Steven 
Bar-shalom, Tali 
Biersack, Walter 
Broun, Laurence 
Companion, Tod 
Conklin, Craig 
Daly, Kevin 
Dickson, Howard 
Dolce, Robert 
Edelman, Phil 
Fancher, Raymond 
Finan, William 
Fuller, Gordon 
Gillin, MAJ Jeff 
Gosnell, William 
Gruber, Corey 
Guffanti, Marianne 
Hastings, Thomas 
Hatchett, Richard 
Havens, Kathryn 
Ippoliito, David 
Irwin, William 
Jones, Gregg 
Jorgensen, Andy 
Kadlec, Robert 
Kerr, Larry 
Kevern, Thomas 
Krueger, Steve 
Landry, Steve 
Lim, Kent 
Lowe, Tom 
Lustig, Teresa 
Lystra, Clark 
MacKinney, John 
Maddox, Justin 
Malak, Patricia 



Department of Energy 

Department of Justice, ATF 

White House Office of Science and Technology Policy 

Department of Energy 

Department of the Interior 

National Aeronautics and Space Administration 

Department of Homeland Security, FEMA 

Department of Justice, FBI 

Department of Homeland Security 

Department of State 

Department of Health & Human Services 

Department of Justice, FBI 

Environmental Protection Agency 

Department of Justice, FBI 

Department of Defense 

Department of Defense, US ACE 

Department of Homeland Security, Integration Staff 

Department of the Interior, USGS 

Department of State 

Department of Health & Human Services 

National Aeronautics & Space Administration 

Department of Labor, OSHA 

Department of Defense, US ACE 

Department of Defense 

Department of Defense 

White House Homeland Security Council 

White House Office of Science and Technology Policy 

Nuclear Regulatory Commission 

Department of Justice, FBI 

Department of Homeland Security, ODP 

Department of Commerce 

Department of State 

Department of Homeland Security 

Department of Defense 

Environmental Protection Agency 

Department of Energy 

Department of Homeland Security, ODP 
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Martin, Mark 
McClenney, Lucretia 
McCreight, Robert 
McGarry, Sherri 
Metzler, John 
Michling, Suzanne 
Mjoness, Mark 
Mize, W. Keith 
Morzinski, Gregory 
Mullin, Jonathan 
Newton, Robert 
Nicholas, Paul 
Noji, Eric 
Park, Tom 
Pavetto, Carl 
Peluso, Francis 
Pond, Robert 
Pratt, Britt 
Siebert, Mark 
Sizemore, R. Tom 
Smith, Alan 
Steele, Scott 
Stephens, David 
Taborn, Michael 
Thomas, Lori 
Tupin, Edward 
Venkayya, Rajeev 
Webster, James 
Weidner, John 
Williams, John 
Williamson, Suzanne 
Winters, Stephen 
Young, Bruce 



Department of Justice, ATF 

Department of Veterans Administration 

Department of State 

Department of Health & Human Services, FDA 

Department of Energy 

Department of Defense 

Environmental Protection Agency 

Department of Energy 

Department of Defense 

National Aeronautic and Space Administration 

Terrorist Threat Analysis Center 

White House Homeland Security Council 

Department of Health & Human Services, CDC 

Department of Homeland Security, FEMA 

Environmental Protection Agency 

Department of Transportation, FAA 

Department of Homeland Security, USCG 

Department of Agriculture 

Department of Justice, ATF 

Department of Veterans Administration 

Department of Agriculture, APHIS 

Department of Justice, FBI 

White House National Security Council 

Department of Transportation, FTA 

Department of Agriculture 

Environmental Protection Agency 

White House Homeland Security Council 

Department of State 

Department of Homeland Security 

Department of Agriculture 

Department of Justice, FBI 

Department of Defense 

Department of Veterans Administration 
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